The US Federal Bureau of Investigation has attributed the theft of more than $6 billion from Binance to North Korea's TraderTraitor operation, according to an Oct. 31 security alert. The agency linked the Oct. 29 attack to North Korean cyber actors, providing official US government confirmation of the perpetrators behind one of the largest cryptocurrency thefts on record.
The FBI said investigators working alongside the US Secret Service and IRS Criminal Investigation observed the attackers converting stolen assets primarily into Ethereum. The agency warned that the hackers were expected to move those holdings through decentralized finance protocols and instant swap services to obscure their origins.
Addresses published, service providers asked to block
To disrupt those efforts, the FBI published hundreds of cryptocurrency addresses associated with the theft. It urged THORNode operators, RPC node operators, DeFi platforms, instant exchanges and other service providers to block transactions involving the identified wallets.
Laundering through Tron lending protocols
The appeal comes as blockchain analytics firm Chainalysis has identified laundering operations already underway across decentralized platforms. According to Chainalysis, the hackers have been using DeFi lending protocols on Tron to circumvent stablecoin freezes, which have already restricted approximately $3 billion in stolen assets.
The technique involves converting TRX into stablecoins, depositing those assets into lending protocols and receiving deposit receipt tokens that stablecoin issuers cannot directly freeze. The attackers then transfer the receipt tokens to fresh wallets, redeem them for stablecoins and bridge the funds into assets such as ETH.
Chainalysis traced approximately $500,000 through this process, illustrating how the attackers could draw on DeFi liquidity while limiting their exposure to asset freezes.
A double refund and an emergency pause
Separately, Chainalysis reported that an unrelated technical failure on THORChain inadvertently disrupted another laundering route used by the Binance attackers. An Ethereum blockchain reorganization caused THORChain to mistakenly issue a double refund on a 10 ETH deposit, triggering an emergency pause that prevented users, including the North Korean hackers, from conducting swaps across most of its bridges.
The disruption was temporary and indiscriminate rather than a deliberate attempt to block stolen funds.
Prior scrutiny over Bitget funds
THORChain has previously faced criticism for facilitating transactions involving stolen cryptocurrency. In September, the protocol rejected calls to block funds linked to Bitget's $388 million hack, arguing that its permissionless architecture prevented selective transaction censorship.
The controversy coincided with a surge in THORChain activity. The protocol earned about 63% of its $3 million September income during the five-day hack-linked trading surge, according to the report.
THORChain has maintained that emergency network shutdowns, including one following its own $11 million exploit in May, are fundamentally different from blacklisting individual addresses.
Responding to the FBI's latest appeal, THORChain co-founder Chad Barraford said node operators held no information beyond what was publicly available in real time.
"No subpoenas required, a best case scenario for investigations," he wrote.
