Following Binance’s roughly $6.3 billion hack, the FBI asked THORChain node operators and other decentralized finance (DeFi) services to block transactions linked to the stolen funds.
The request came on October 31. THORChain’s nodes operate independently, and no single authority can make them block the transactions.
What the FBI asked for, and what Barraford said back
The bureau blamed TraderTraitor—its name for a North Korean state-linked hacking operation—for the October 29 theft. It asked services to block listed wallets and transactions derived from them. The attackers, it said, were converting stolen crypto into Ether.
The FBI has identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. However, it has not included any address on Tron despite the fact that this blockchain has been widely used to move the stolen funds.
According to Chad Barraford, the technical co-founder of THORChain, node operators have already been able to see transactions on public blockchains. He informed The Block that the official website had blocked the aforementioned addresses. However, he expects the independent node operators to continue trading as before.
Where the frontend ends, and the nodes begin
It is important to differentiate between THORChain’s website and the THORChain network itself. The website serves the function of giving the option to perform a swap. But the protocol works through separate nodes that can be reached through other interfaces.
This means that the blocking of an address from the site does not mean that a transaction cannot be conducted in another way. So far, it’s unclear whether node operators have blocked those addresses across the network.
A separate halt that caught legitimate users
Another issue then led to the halting of trading activity. On 31 October, an Ethereum block reorganization occurred, which prompted THORChain to refund 10 ETH coming from vaults that had not received deposits.
The shortfall was picked up by the solvency checker. This forced the operators to prolong the break and, as a result, on 1 November, trading on 10 out of the connected 13 chains was suspended. All parties suffered losses. The halt was meant to protect the network, not to carry out the FBI’s request.
The numbers are estimates, not settled facts
The stolen funds moved swiftly, complicating the ability to accurately gauge the total amount. Analyst SomaXBT believes that around $242 million was transferred via the Tron blockchain in two days.
The vast majority, about $140 million, of this total was transferred through a variety of cross-chain services. Relay transferred almost $48 million, THORChain moved $44 million, Chainflip transferred $32.1 million, and Symbiosis $16 million. The aforementioned figures are estimates.
Additionally, they do not suggest that THORChain had any knowledge of the hackers’ wrongdoing.
Why screening one wallet at a time may not hold
The rapid movement of stolen funds makes wallet-by-wallet screening difficult. Elliptic tracked about 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days. It found signs of automated laundering, but no evidence that AI agents were directing it. With funds constantly moving to new wallets, fixed blocklists can quickly fall behind.
For THORChain, the challenge is how quickly it can respond. In an earlier debate, researcher Taylor Monahan argued that the network could halt suspicious routes. Barraford maintained that reaching two-thirds node consensus—agreement from a supermajority of operators—could take days or weeks. Acting faster, he argued, would require more centralized control.
The stakes for liquidity, compliance and trust
Binance, meanwhile, is working to rebuild customer confidence. The exchange completed proof of reserves, a snapshot showing whether specified customer balances are backed by assets. It also promised to cover the losses.
Still, Reuters reported $4.72 billion in net withdrawals, about 3% of platform assets, despite $2.7 billion in inflows. Cryptopolitan has previously examined THORChain’s exposure to stolen funds. The latest case brings a familiar challenge back into focus: how can DeFi keep liquidity open without compromising compliance and user trust?
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free.
This articles is written by : Nermeen Nabil Khear Abdelmalak
All rights reserved to : USAGOLDMIES . www.usagoldmines.com
You can Enjoy surfing our website categories and read more content in many fields you may like .
Why USAGoldMines ?
USAGoldMines is a comprehensive website offering the latest in financial, crypto, and technical news. With specialized sections for each category, it provides readers with up-to-date market insights, investment trends, and technological advancements, making it a valuable resource for investors and enthusiasts in the fast-paced financial world.