CryptoSlate
The FBI attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor operation, naming the group in an Oct. 31 security alert about the Oct. 29 attack. Investigators said the attackers were converting stolen assets primarily into Ethereum and warned they were expected to use DeFi protocols and instant swap services to conceal the funds’ origins.
The agency published hundreds of associated cryptocurrency addresses and urged THORNode and RPC node operators, DeFi platforms, instant exchanges and other providers to block transactions involving them.
Why it matters
The FBI’s call lands amid evidence that laundering is already adapting to asset freezes. Chainalysis said the attackers used DeFi lending protocols on Tron to move around stablecoin restrictions that have affected approximately $3 billion in stolen assets. The process converts TRX into stablecoins, deposits them into lending protocols, then moves receipt tokens to fresh wallets before redeeming and bridging funds into assets such as ETH. Chainalysis traced approximately $500,000 through this method.
The episode sharpens a core tension for permissionless services: whether operators should act on law-enforcement requests to block identified wallets, even when selective censorship conflicts with a protocol’s design.
Market impact
An unrelated Ethereum blockchain reorganization caused THORChain to issue a double refund on a 10 ETH deposit, triggering an emergency pause that temporarily halted swaps across most of its bridges. The pause affected all users, including the attackers, but was not a deliberate block on stolen funds.
THORChain has previously rejected calls to block funds linked to a separate $388 million Bitget hack. Its co-founder Chad Barraford said node operators had no information beyond what was publicly available in real time. The FBI’s appeal now puts the protocol’s response, and the practical limits of address-based intervention, back in focus.
Frequently asked questions
-
Who did the FBI identify as responsible for the Binance theft?
The FBI attributed the theft of more than $6 billion to North Korea’s TraderTraitor operation in an Oct. 31 security alert.
-
What did the FBI ask DeFi and swap providers to do?
It published hundreds of cryptocurrency addresses associated with the theft and urged providers, including THORNode operators, to block transactions involving those wallets.
-
How did the attackers use Tron lending protocols to evade freezes?
Chainalysis said they converted TRX into stablecoins, deposited them into lending protocols, and moved receipt tokens through fresh wallets before redeeming and bridging the funds.
-
Why did THORChain swaps temporarily stop?
An unrelated Ethereum blockchain reorganization led THORChain to issue a double refund on a 10 ETH deposit, triggering an emergency pause across most bridges.
-
Was THORChain’s temporary pause a deliberate effort to block the attackers?
No. The pause resulted from the technical failure and affected all users, including the attackers; it was not a targeted block on stolen funds.
Lookonchain
WuBlockchain
Crypto News
CoinDesk
CoinTelegraph
TheBlock