FBI links North Korea to $6B Binance hack, asks THORChain to block funds

The FBI has blamed North Korea's TraderTraitor operation for stealing more than $6 billion from Binance. In an Oct. 31 security alert, the agency tied the Oct. 29 attack to North Korean cyber actors. That gives official US government confirmation of who carried out one of the largest crypto thefts on record.

Investigators worked with the US Secret Service and IRS Criminal Investigation. According to the FBI, they saw the attackers converting the stolen assets mainly into Ethereum. The agency said it expected the hackers to push those holdings through DeFi protocols and instant swap services to hide where the money came from.

To disrupt the laundering, the FBI published hundreds of cryptocurrency addresses tied to the theft. It urged THORNode operators, RPC node operators, DeFi platforms, instant exchanges and other providers to block transactions involving those wallets.

The request puts THORChain under fresh scrutiny. The protocol has been criticized before for handling transactions involving stolen crypto. In September it rejected calls to block funds linked to Bitget's $388 million hack, arguing that its permissionless design prevented selective censorship of transactions.

Blockchain analytics firm Chainalysis has already identified laundering operations running across decentralized platforms. According to Chainalysis, the hackers used DeFi lending protocols on Tron to get around stablecoin freezes. Those freezes have already restricted roughly $3 billion in stolen assets.

The method: convert TRX into stablecoins, deposit them into lending protocols, and receive deposit receipt tokens that stablecoin issuers cannot freeze directly. The attackers then send the receipt tokens to fresh wallets, redeem them for stablecoins, and bridge the funds into assets such as ETH. Chainalysis traced about $500,000 through this process.

Chainalysis also reported an unrelated technical failure on THORChain that disrupted another laundering route used by the Binance attackers. An Ethereum blockchain reorganization caused THORChain to issue a double refund by mistake on a 10 ETH deposit. That triggered an emergency pause.

The pause stopped users, including the North Korean hackers, from swapping across most of its bridges. Chainalysis described the disruption as temporary and indiscriminate, not a deliberate attempt to block stolen funds.

The September controversy coincided with a jump in THORChain activity. The protocol earned about 63% of its $3 million September income during the five-day trading surge linked to the hack, according to CryptoSlate · Crypto news.

What remains to confirm is whether THORNode operators and the other providers the FBI named will act on the published addresses. The agency's alert lists the wallets but does not say who has committed to blocking them.