THORChain Binance Hack Funds Keep Flowing Despite FBI Alert
THORChain moved over $46 million of Binance hack funds in 72 hours despite an FBI plea to block them, WSJ says. Why can't anyone stop North Korea's laundering?
Hakkı ALKANPublished 3 min read
In the latest THORChain Binance hack revelation, the cross-chain swap network, which has no user accounts, kept processing stolen funds even after the FBI blamed North Korea for the theft, according to a Wall Street Journal investigation. Chainalysis data cited by the Journal shows the attackers began laundering within minutes, split the money across more than 10,000 wallets and pushed more than $46 million through THORChain in the first 72 hours.
That flow generated more than $200,000 in fees, revenue that goes to the node operators who run THORChain's infrastructure. In the same window, nearly $4 million went through Wasabi Wallet's coin mixing feature, which hides where Bitcoin transfers came from. The Journal also reports that THORChain handled about $1 billion stolen in the 2025 Bybit hack, earning more than $12 million in fees, and says it cannot stop transfers.
What Did the FBI Ask in the THORChain Binance Hack Case?
Binance lost about $6.3 billion on Oct. 29, the largest crypto theft on record, as we covered in our Binance hack report. Two days later, an FBI alert attributed the attack to "TraderTraitor," the bureau's name for a North Korean group also tracked as Lazarus Group. North Korea denies involvement.
In that FBI alert, issued with the Secret Service and IRS Criminal Investigation, the bureau urged "THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets." It also lists hundreds of wallet addresses linked to the theft.
Why Can't THORChain Simply Block the Stolen Funds?
THORChain US co-founder Chad Barraford said on a podcast in October that the protocol cannot audit individual transactions or wallets because the code to do so does not exist. He told The Block on Nov. 1 that the official THORChain frontend had blocked the FBI-flagged addresses, but that he expected node operators to "resume trading as normal."
Critics are not convinced. Nick Carlsen, a former FBI analyst now at TRM Labs, told the Journal that THORChain is the biggest channel for North Korean laundering and that its decentralization claims mask a centralized, profitable operation. The timing adds pressure on Binance as well, which saw its CFO step down a week after the breach.
How Much of the Stolen Crypto Is Still Out There?
The Journal says about half of the stolen funds have been frozen, yet tracing firms estimate the attackers still control nearly $3 billion. Freezing is not recovery. Stablecoin issuers can lock USDT or USDC, but once funds become Bitcoin or Ether, no issuer can freeze them. Binance has said it replenished about 98% of affected tokens with company money.
| Figure | Source |
|---|---|
| $6.3 billion stolen on Oct. 29 | Binance, FBI |
| More than 10,000 wallets used | Chainalysis via WSJ |
| More than $46 million through THORChain in 72 hours | Chainalysis via WSJ |
| More than $200,000 in THORChain fees | Chainalysis via WSJ |
| Nearly $4 million through Wasabi Wallet | Chainalysis via WSJ |
| Nearly $3 billion still controlled by attackers | Tracing firms via WSJ |
Our Take
The THORChain Binance hack episode is a stress test for DeFi's "we can't intervene" argument. Banks must screen for laundering; swap networks that earn fees from the same flows face no equivalent rule. For readers holding crypto, it is another reason to keep long-term funds in a cold wallet rather than on any single platform.