FBI ties $6 billion Binance hack to North Korea, urges THORChain nodes to block funds
In brief
- FBI's Oct. 31 alert blamed North Korea's TraderTraitor for the more than $6 billion Binance theft.
- Stolen assets were being converted mainly into Ethereum, the FBI said.
- Tron lending protocols were used to get around stablecoin freezes, Chainalysis said.
- An unrelated THORChain glitch briefly disrupted one of the attackers' laundering routes, Chainalysis said.
Where the FBI says the money is going
The FBI said investigators working with the US Secret Service and IRS Criminal Investigation saw the attackers converting stolen assets mainly into Ethereum. The agency warned that the hackers were expected to push those holdings through DeFi protocols and instant swap services to hide where they came from. That's why the alert's list of hundreds of cryptocurrency addresses went to RPC node operators, instant exchanges and other service providers, not just THORNode operators.
Chainalysis tracks a Tron workaround
According to Chainalysis, the hackers used DeFi lending protocols on Tron to get around stablecoin freezes, which had restricted about $3 billion in stolen assets. Here's how it worked. They converted TRX into stablecoins, deposited them into lending protocols and received deposit receipt tokens that issuers couldn't directly freeze. Those receipt tokens then moved to fresh wallets, got redeemed for stablecoins and were bridged into assets such as ETH.
Chainalysis traced about $500,000 through this process.
THORChain's accidental pause
Chainalysis also reported that an unrelated technical failure on THORChain disrupted another laundering route the attackers were using. An Ethereum blockchain reorganization caused THORChain to issue a double refund on a 10 ETH deposit by mistake, which triggered an emergency pause that stopped users (the North Korean hackers included) from swapping across most of its bridges. It was temporary and indiscriminate. It wasn't a deliberate attempt to block stolen funds.
CryptoSlate has previously reported that THORChain faced criticism for facilitating transactions involving stolen crypto. According to that reporting, the protocol rejected calls in September to block funds linked to Bitget's $388 million hack, arguing its permissionless architecture prevented selective censorship, and it earned about 63% of its $3 million September income during the five-day trading surge tied to that hack. CryptoSlate also reported that THORChain has maintained that emergency shutdowns (including one after its own $11 million exploit in May) are fundamentally different from blacklisting individual addresses.
Responding to the FBI's appeal, co-founder Chad Barraford said node operators held no information beyond what's publicly available in real time.
“No subpoenas required, a best case scenario for investigations,” he wrote.
Frequently asked questions
How did the Binance hackers get around stablecoin freezes?
According to Chainalysis, the hackers converted TRX into stablecoins and deposited them into Tron lending protocols. They received deposit receipt tokens that issuers couldn't directly freeze, moved those to fresh wallets, redeemed them for stablecoins and bridged into assets such as ETH. Chainalysis traced about $500,000 through this route.
Why did THORChain pause swaps during the Binance laundering?
Chainalysis reported that an Ethereum blockchain reorganization caused THORChain to issue a double refund on a 10 ETH deposit by mistake. That triggered an emergency pause across most of its bridges, which also stopped the North Korean hackers. The disruption was temporary and indiscriminate, not a deliberate attempt to block stolen funds.
