FBI Urges THORChain to Block Binance Hack Funds, Reviving $12M Bybit Laundering Fee Controversy
Key Takeaways
- The FBI has specifically urged THORChain node operators to block transactions linked to Binance’s $6.3 billion hack, which it attributes to North Korea’s TraderTraitor operation.
- Blockchain intelligence firm Elliptic traced $25 million in suspected Binance hack proceeds through THORChain by Oct. 31, raising fresh questions about the protocol’s role in moving stolen cryptocurrency.
- THORChain previously faced criticism over its handling of funds stolen from Bybit in 2025, including claims that participants earned millions in fees while hackers converted stolen assets into Bitcoin.
THORChain is facing renewed scrutiny after the FBI directly called on its node operators to help prevent North Korean hackers from laundering cryptocurrency stolen in the $6.3 billion Binance breach.
In an Oct. 31 advisory, the agency identified North Korea’s TraderTraitor operation as responsible for the Oct. 29 attack and published cryptocurrency addresses associated with the stolen assets.
The FBI’s appeal specifically included THORNode operators alongside instant exchanges, decentralized finance platforms, blockchain infrastructure providers and analytics companies.
The request places THORChain at the center of a familiar controversy: How much responsibility should a decentralized protocol bear when criminals use its infrastructure to move stolen funds?
FBI Names THORChain Operators in Binance Hack Warning
The FBI said the attackers were converting stolen assets primarily into Ethereum before potentially moving them through decentralized finance services and instant-swap platforms.
Working with the US Secret Service and IRS Criminal Investigation, the bureau urged cryptocurrency infrastructure providers to block transactions involving addresses linked to the theft.
The agency’s official advisory includes Bitcoin, Ethereum, and Solana addresses believed to hold or have previously handled stolen assets.
Importantly, the warning is a request for cooperation, not a finding that THORChain itself participated in the attack.
However, blockchain tracing indicates the protocol has already been used to move some of the proceeds.
In its Oct. 31 investigation, Elliptic identified approximately $25 million flowing through THORChain from wallets associated with the Binance theft.
Elliptic also described automated laundering patterns, with repeated transfers and rapidly changing destination addresses complicating attempts to identify and block suspicious activity.
The findings illustrate why static address blacklists may struggle against attackers capable of creating fresh wallets and routing funds through multiple services.
THORChain’s $12M Bybit Fee Controversy Returns
The FBI’s latest warning revives criticism of THORChain’s role in laundering cryptocurrency stolen from Bybit in February 2025.
North Korean hackers stole approximately $1.5 billion from Bybit before converting substantial amounts of Ethereum (ETH) into Bitcoin (BTC) through cross-chain services.
THORChain became a major route for those conversions, prompting debate among developers, validators and security researchers over whether transactions linked to the theft should be blocked.
Claims circulated that approximately 85% of the stolen assets were converted into Bitcoin through THORChain and that node operators, liquidity providers and front-end services collectively earned $12 million in fees.
Nevertheless, the underlying controversy is well documented: THORChain facilitated substantial cross-chain conversions linked to the Bybit attackers.
The latest Binance incident renews questions about whether a protocol that collects transaction fees should intervene when authorities identify funds associated with a major theft.
THORChain’s Decentralization Defense Faces a New Test
THORChain’s architecture complicates the debate.
Unlike a conventional centralized exchange, THORChain uses a threshold signature scheme (TSS), in which multiple validators collectively authorize outgoing transactions from shared vaults.
Its technical documentation explains that no individual validator possesses the complete private key. Instead, a supermajority of participating nodes must cooperate to sign transactions.
The network also has mechanisms for suspending trading or signing activity. Its developer documentation describes several types of emergency and chain-specific halts.
Those capabilities have prompted critics to question whether THORChain can claim to be entirely unable to intervene when stolen assets pass through its infrastructure.
However, the ability to suspend a network does not automatically mean validators can selectively blacklist individual addresses without additional protocol changes or coordinated action.
THORChain technical co-founder Chad Barraford responded to the FBI’s appeal by emphasizing that node operators possess no private transaction information unavailable to investigators.
His comments did not establish whether the network would comply with the FBI’s request to block identified addresses.
A separate technical incident has already interrupted some activity. An Ethereum chain reorganization reportedly caused THORChain to issue an incorrect double refund involving 10 ETH, triggering an emergency pause that also temporarily prevented suspected Binance attackers from using affected cross-chain swaps.
The interruption was not a deliberate enforcement action. The larger question now extends beyond THORChain.
As North Korean hackers increasingly use decentralized infrastructure to convert stolen assets, regulators and protocol operators face a growing conflict between permissionless transactions, technical control, and financial-crime prevention.
For THORChain, the immediate test is whether its operators will take action against the addresses identified by the FBI or continue to allow the network’s existing transaction rules to determine which transfers proceed.
The FBI has made its request public. THORChain has yet to establish publicly whether it will implement targeted restrictions in response.
