The movement of stolen cryptocurrency across decentralized platforms has raised fresh questions about security and accountability in DeFi.
Authorities increasingly face challenges tracking illicit funds as hackers move assets between blockchains.
The latest Binance hack has brought these concerns into focus, placing cross-chain protocols under pressure. THORChain now faces questions about how it can respond to law enforcement requests without compromising its decentralized structure.
FBI asks THORChain nodes to block Binance hack funds
The FBI has asked THORChain node operators and other decentralized finance (DeFi) services to block transactions linked to Binance’s $6.3 billion hack. The request came on October 31, following the October 29 theft attributed to North Korean hackers.
The bureau blamed TraderTraitor, its designation for a North Korean state-linked hacking operation. It asked cryptocurrency services to block identified wallets and transactions originating from those addresses. The FBI also said the attackers were converting stolen assets into Ether.
Its investigation identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. However, the list excluded Tron addresses despite the blockchain’s extensive use in moving the stolen funds.
THORChain technical co-founder Chad Barraford told The Block that node operators could already monitor transactions across public blockchains. He also confirmed that THORChain’s official website had blocked the identified addresses.
However, Barraford expected independent node operators to continue processing transactions as before. THORChain’s decentralized structure prevents a single authority from imposing network-wide restrictions.
THORChain website restrictions expose decentralized network limits
The FBI’s request highlights the difference between THORChain’s website and its underlying protocol. The website provides an interface through which users can execute cryptocurrency swaps. However, independent nodes operate the protocol and remain accessible through alternative interfaces.
Consequently, blocking an address through the official website does not prevent users from accessing the network elsewhere. Transactions could still proceed through other interfaces if node operators continued processing them.
It remains unclear whether individual operators have introduced restrictions across the entire network. Researcher Taylor Monahan previously argued that THORChain could suspend suspicious transaction routes.
Barraford, however, said achieving agreement from two-thirds of node operators could take days or weeks. He argued that faster intervention would require greater centralized control.
Meanwhile, a separate technical incident disrupted THORChain’s operations. An Ethereum block reorganization occurred on October 31, prompting the protocol to refund 10 ETH from vaults that had not received corresponding deposits.
The shortfall triggered THORChain’s solvency checker, forcing operators to extend the trading suspension. On November 1, the network halted trading across 10 of its 13 connected blockchains. The suspension aimed to protect network solvency rather than implement the FBI’s request. Legitimate users also experienced disruptions.
Stolen funds movement complicates screening and compliance
Blockchain analyst SomaXBT estimated that approximately $242 million moved through Tron within two days. Around $140 million reportedly passed through various cross-chain services.
Relay handled nearly $48 million, while THORChain transferred approximately $44 million. Chainflip moved $32.1 million, and Symbiosis processed another $16 million. These figures remain estimates and do not establish that THORChain knowingly facilitated criminal transactions.
Elliptic tracked approximately 12,000 wallets across 11 blockchains and more than 40,000 transactions within four days. Its investigation identified signs of automated laundering but found no evidence that AI agents directed the activity.
The constant movement between wallets makes fixed blocklists increasingly difficult to maintain. New addresses can emerge faster than services update their screening systems.
Meanwhile, Binance has completed a proof-of-reserves snapshot and pledged to cover customer losses. Reuters reported $4.72 billion in net withdrawals despite $2.7 billion in inflows. The withdrawals represented approximately 3% of the exchange’s platform assets.
The incident leaves THORChain facing a difficult balance between liquidity, compliance and decentralization. Its response also highlights the limits of traditional wallet screening when stolen cryptocurrency moves rapidly across multiple networks.
