The US Federal Bureau of Investigation (FBI) has blamed North Korea’s TraderTraitor operation for stealing more than $6 billion from Binance.
In an Oct. 31 security alert, the agency attributed the Oct. 29 attack to North Korean cyber actors, providing official US government confirmation of the perpetrators behind one of history’s largest cryptocurrency thefts.
The FBI said investigators working alongside the US Secret Service and IRS Criminal Investigation had observed the attackers converting stolen assets primarily into Ethereum.
It warned that the hackers were expected to move those holdings through decentralized finance (DeFi) protocols and instant swap services to obscure their origins.
To disrupt those efforts, the agency published hundreds of cryptocurrency addresses associated with the theft and urged THORNode operators, RPC node operators, DeFi platforms, instant exchanges and other service providers to block transactions involving the identified wallets.
THORChain faces fresh scrutiny as hackers exploit DeFi platforms
The FBI’s intervention comes as blockchain analytics firm Chainalysis has identified sophisticated laundering operations already underway across decentralized platforms.
According to Chainalysis, the hackers have been using DeFi lending protocols on Tron to circumvent stablecoin freezes, which have already restricted approximately $3 billion in stolen assets.
The technique involves converting TRX into stablecoins, depositing those assets into lending protocols, and receiving deposit receipt tokens that stablecoin issuers cannot directly freeze.
The attackers then transfer the receipt tokens to fresh wallets, redeem them for stablecoins, and bridge the funds into assets such as ETH.
Chainalysis traced approximately $500,000 through this process, demonstrating how the attackers could exploit DeFi liquidity while minimizing their exposure to asset freezes.
Meanwhile, Chainalysis reported that an unrelated technical failure on THORChain inadvertently disrupted another laundering route used by the Binance attackers.
An Ethereum blockchain reorganization caused THORChain to mistakenly issue a double refund on a 10 ETH deposit, triggering an emergency pause that prevented users, including the North Korean hackers, from conducting swaps across most of its bridges.
The disruption was temporary and indiscriminate rather than a deliberate attempt to block stolen funds.
THORChain has previously faced criticism for facilitating transactions involving stolen cryptocurrency.
In September, the protocol rejected calls to block funds linked to Bitget’s $388 million hack, arguing that its permissionless architecture prevented selective transaction censorship.
The controversy coincided with a surge in THORChain’s activity. The protocol earned about 63% of its $3 million September income during the five-day hack-linked trading surge.
The protocol maintained that emergency network shutdowns, including one following its own $11 million exploit in May, were fundamentally different from blacklisting individual addresses.
Responding to the FBI’s latest appeal, THORChain co-founder Chad Barraford said node operators held no information beyond what was publicly available in real time.
“No subpoenas required, a best case scenario for investigations,” he wrote.