FBI blames North Korea for $6 billion Binance hack, urges THORChain to block stolen funds

The FBI has officially attributed the October 29 theft of more than $6 billion from Binance to North Korean hackers.

In a security alert, the agency confirmed the attack was carried out by North Korean cyber actors and warned that the stolen assets were being moved through decentralized finance protocols.

The FBI has published hundreds of cryptocurrency addresses linked to the theft and is urging THORNode operators, RPC node operators, and other service providers to block transactions involving these wallets.

The agency said investigators had observed the attackers converting stolen assets primarily into Ethereum.

It warned that the hackers were expected to move those holdings through DeFi protocols and instant swap services to obscure their origins.

DeFi laundering methods

The FBI's intervention comes as blockchain analytics firm Chainalysis has identified sophisticated laundering operations already underway across decentralized platforms.

According to Chainalysis, the hackers have been using DeFi lending protocols on Tron to circumvent stablecoin freezes, which have already restricted approximately $3 billion in stolen assets.

The technique involves converting TRX into stablecoins, depositing those assets into lending protocols, and receiving deposit receipt tokens that stablecoin issuers cannot directly freeze.

The attackers then transfer the receipt tokens to fresh wallets, redeem them for stablecoins, and bridge the funds into assets such as ETH.

Chainalysis traced approximately $500,000 through this process, demonstrating how the attackers could exploit DeFi liquidity while minimizing their exposure to asset freezes.

THORChain's role

Meanwhile, Chainalysis reported that an unrelated technical failure on THORChain inadvertently disrupted another laundering route used by the Binance attackers.

An Ethereum blockchain reorganization caused THORChain to mistakenly issue a double refund on a 10 ETH deposit, triggering an emergency pause that prevented users, including the North Korean hackers, from conducting swaps across most of its bridges.

The disruption was temporary and indiscriminate rather than a deliberate attempt to block stolen funds.

THORChain has previously faced criticism for facilitating transactions involving stolen cryptocurrency.

In September, the protocol rejected calls to block funds linked to Bitget's $388 million hack, arguing that its permissionless architecture prevented selective transaction censorship.

The controversy coincided with a surge in THORChain's activity. The protocol earned about 63% of its $3 million September income during the five-day hack-linked trading surge.

The protocol maintained that emergency network shutdowns, including one following its own $11 million exploit in May, were fundamentally different from blacklisting individual addresses.