The US Federal Bureau of Investigation (FBI) has officially attributed a massive $6 billion theft from Binance to North Korea’s TraderTraitor operation.
In a security alert issued on October 31, the agency formally linked the October 29 attack to North Korean cyber actors. This provides official U.S. government confirmation of the perpetrators behind one of the largest cryptocurrency thefts in history.
According to the FBI, investigators collaborating with the U.S. Secret Service and IRS Criminal Investigation observed the attackers converting the stolen assets primarily into Ethereum.
The agency warned that the hackers are likely to move these holdings through decentralized finance (DeFi) protocols and instant swap services in an attempt to obscure their origins.
To disrupt these laundering efforts, the FBI published hundreds of cryptocurrency addresses associated with the theft. The agency urged THORNode operators, RPC node operators, DeFi platforms, instant exchanges, and other service providers to block transactions involving the identified wallets.
THORChain Faces Fresh Scrutiny as Hackers Exploit DeFi Platforms
The FBI’s intervention comes as blockchain analytics firm Chainalysis has identified sophisticated laundering operations already underway across various decentralized platforms.
According to Chainalysis, the hackers have been utilizing DeFi lending protocols on the Tron network to circumvent stablecoin freezes. These freezes have already restricted approximately $3 billion in stolen assets.
This technique involves converting TRX into stablecoins, depositing those assets into lending protocols, and receiving deposit receipt tokens that stablecoin issuers cannot directly freeze.
The attackers then transfer these receipt tokens to fresh wallets, redeem them for stablecoins, and bridge the funds into other assets such as ETH.
Chainalysis traced approximately $500,000 through this process, demonstrating how the attackers can exploit DeFi liquidity while minimizing their exposure to asset freezes.
Meanwhile, Chainalysis reported that an unrelated technical failure on THORChain inadvertently disrupted another laundering route previously used by the Binance attackers.
An Ethereum blockchain reorganization caused THORChain to mistakenly issue a double refund on a 10 ETH deposit. This triggered an emergency pause that prevented all users, including the North Korean hackers, from conducting swaps across most of its bridges.
The disruption was temporary and indiscriminate, serving as an unintended obstacle rather than a deliberate attempt to block stolen funds.
THORChain has previously faced significant criticism for facilitating transactions involving stolen cryptocurrency.
In September, the protocol rejected calls to block funds linked to Bitget’s $388 million hack, arguing that its permissionless architecture inherently prevents selective transaction censorship.
This controversy coincided with a surge in THORChain’s activity. During the five-day hack-linked trading surge, the protocol earned approximately 63% of its $3 million September income.
The protocol maintained that emergency network shutdowns, including one following its own $11 million exploit in May, are fundamentally different from blacklisting individual addresses.
Responding to the FBI’s latest appeal, THORChain co-founder Chad Barraford stated that node operators do not hold any information beyond what is publicly available in real time.
“No subpoenas required, a best case scenario for investigations,” he wrote.
Also Read
- UKCBC Advocates for Government Endorsement of Clause 50 in Financial Services Bill
- Dollar Teetering as Midterm Elections, Jobs Data, and AI Risks Loom This Week
- Asia’s T+1 Transition Takes Multiple Paths
- USD/JPY Bearish Outlook: Yen Poised to Strengthen as BoJ Tightening Looms and Carry Trades Unwind