The FBI has attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor cyber operation and called on cryptocurrency infrastructure providers to block transactions linked to the stolen assets.
In a security alert dated October 31, the US agency said the attack on October 29 was carried out by North Korean cyber actors. The statement marked official confirmation from the US government of who it believes was behind one of the largest cryptocurrency thefts reported to date.
The FBI said it was working with the US Secret Service and IRS Criminal Investigation to track the stolen funds. Investigators observed the attackers converting much of the cryptocurrency into Ethereum, while warning that the assets were likely to be routed through decentralized finance, or DeFi, protocols and instant swap services.
According to CryptoSlate, the agency published hundreds of cryptocurrency addresses connected with the theft. It urged THORNode operators, remote procedure call (RPC) node operators, DeFi platforms, instant exchanges and other service providers to block transactions involving those wallets.
DeFi lending is being used to bypass freezes
The FBI’s warning came as blockchain analytics firm Chainalysis identified activity suggesting that the attackers were already testing ways to move the stolen assets through decentralized platforms.
Chainalysis said the hackers had used DeFi lending protocols on the Tron blockchain to work around freezes placed on approximately $3 billion in stolen stablecoins. Stablecoins are cryptocurrencies designed to maintain a relatively stable value, often by tracking a reference asset. Issuers can sometimes freeze tokens held at specific addresses, but DeFi structures can create additional layers between the original assets and the wallets controlling them.
The method identified by Chainalysis begins with the conversion of TRX into stablecoins. Those stablecoins are then deposited into lending protocols, which issue deposit receipt tokens in return. Because the receipt tokens are separate blockchain assets, stablecoin issuers cannot directly freeze them in the same way they can freeze the underlying stablecoins.
The receipt tokens can then be sent to newly created wallets and redeemed for stablecoins. From there, the funds may be moved across blockchain networks, including into assets such as ETH. Chainalysis traced about $500,000 through this process, illustrating how the attackers could access DeFi liquidity while reducing their exposure to direct asset freezes.
THORChain disruption temporarily stopped swaps
THORChain has also become part of the investigation because its cross-chain infrastructure can facilitate swaps between assets on different blockchains. A technical incident, rather than a targeted intervention, temporarily interrupted that route for the attackers and other users.
An Ethereum blockchain reorganization caused THORChain to issue a duplicate refund on a 10 ETH deposit. The error triggered an emergency pause, stopping swaps across most of the protocol’s bridges. The halt affected all users, including the individuals moving funds linked to the Binance theft, but it was not designed specifically to blacklist or seize the stolen cryptocurrency.
The incident has renewed scrutiny of THORChain’s role in transactions involving hacked assets. In September, the protocol rejected requests to block cryptocurrency connected with Bitget’s $388 million hack. Its position was that a permissionless system could not selectively censor individual transactions.
That debate coincided with a sharp increase in activity on the network. THORChain generated approximately 63% of its $3 million September income during a five-day period of trading associated with the Bitget hack.
The protocol has distinguished between an emergency shutdown of the network and the blacklisting of particular addresses. It cited its own emergency response after an $11 million exploit in May as an example of a broad network-level measure rather than selective transaction censorship.
THORChain response and current market picture
THORChain co-founder Chad Barraford responded to the FBI’s appeal by saying that node operators had no information beyond what was publicly available in real time. He wrote: “No subpoenas required, a best case scenario for investigations.”
The FBI’s request places responsibility on a broad group of crypto intermediaries, including infrastructure operators and DeFi services, to identify and reject transactions associated with the addresses released by the agency. At the same time, the laundering activity described by Chainalysis highlights the difficulty of stopping stolen assets once they move through protocols that issue new tokens, use multiple wallets or connect different blockchains.
Moneyiar market data at 12:48 p.m. on November 1, 2026, showed BNB at $711.7068665596, up 0.93% over 24 hours but down 3.7% over seven days. RUNE, the THORChain token, traded at $0.6169944523, down 10.54% over 24 hours and 1.05% over seven days. At 12:48 p.m., Nexus (NEX) was priced at $0.0000006833, down 3.82% in 24 hours and up 13.56% over seven days. Ailey (ALE) stood at $0.2659060987 at 12:49 p.m., little changed over 24 hours with a 0.01% gain and down 0.31% over seven days.
