FBI Confirms North Korea Behind Binance Hack, Seeks Blocks
The FBI has blamed North Korea for Binance’s multibillion-dollar theft and asked crypto infrastructure operators to block linked transactions, testing how much control those services actually have.
Key Takeaways
- FBI attributes the $6 billion theft to North Korea.
- Stolen funds are moving mainly into ETH.
- THORChain can halt its network, not single swaps.
- A blocked transaction is not a recovered one.
In its October 31 announcement, the bureau attributed the theft of more than $6 billion to activity it tracks as TraderTraitor, settling the question of North Korean responsibility that had hung over the case.
Why the request goes to infrastructure
The FBI, Secret Service and IRS Criminal Investigation asked THORNode operators, RPC operators, instant exchanges, DeFi services, analytics firms and other virtual-asset providers to block transactions linked to the addresses they published. The agencies say the stolen assets are being converted mainly into ETH, and they expect further laundering through DeFi and instant-swap services.
That conversion is why the request goes so wide. Stablecoin issuers can freeze their own tokens, and part of the haul was frozen that way within hours. ETH has no issuer to call. Once the attacker moved value into ETH, stopping it depends on the services the funds pass through next.
The address list is the starting point. The FBI describes the listed wallets as holding or having previously held stolen assets, and as operated by or closely connected to TraderTraitor actors. Some may already be empty. Each provider still has to work out what, if anything, it can do within its own role.
Five things “blocking” can mean
Intervention runs from the weakest to the strongest, and only the last rung puts money back:
- Tracing. Analytics firms map where funds move and alert others. Information, not control.
- Refusing a connection. An RPC provider or app interface turns away requests from flagged addresses on its own service.
- Halting a protocol. A network such as THORChain pauses trading or a whole chain, stopping everyone’s transactions, not just the attacker’s.
- Freezing in custody. An exchange or custodian that holds the assets denies access to them.
- Returning funds. Identified assets are actually transferred back.
Each rung needs different evidence. A refused connection shows one service said no. A halt shows activity paused, for a time. A custody freeze shows assets held, pending a legal process. Only a return shows recovery.
Refusing a connection
Applications reach Ethereum through nodes, often run by RPC providers, to read data or send transactions, as Ethereum’s JSON-RPC documentation explains. A provider can refuse requests that pass through its service, but the network’s rules don’t change. Broadcasting, block inclusion and finality are separate stages, and a transaction turned away by one provider can still be sent through another. The same applies to a website that restricts its interface while the underlying protocol keeps running.
Halting a protocol: THORChain’s position
The FBI named THORNode operators directly, which puts THORChain’s design under scrutiny. In an October 1 post, before the Binance theft, the project said its protocol can pause a chain or the whole network for safety but has no control to remove a single swap. Its October 23 quarterly report repeated that.
The developer documentation describes several kinds of pause, from stopping trading to stopping outbound signing to halting a chain. Any of them would catch every user of that route, not only the attacker.
An accident has already shown what an unplanned interruption looks like. On October 31, Chainalysis said an Ethereum block reorganization caused THORChain to issue a duplicate refund to someone who had deposited 10 ETH, which inadvertently delayed the laundering of funds stolen from Binance. That was an operational fault, not a deliberate restriction, and delayed funds are not recovered funds.
THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
The reason? An Ethereum reorg.
One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.
This triggered an “emergency pause” on THORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.
— Chainalysis (@chainalysis) October 31, 2026
Freezing in custody
The strongest point of control is a business that actually holds the assets. ETH has no issuer blacklist, but an exchange or custodian holding stolen ETH for a customer can lock that account. Where sanctions apply, OFAC guidance requires a US person holding blocked virtual currency to deny access and meet holding and reporting rules. The FBI’s alert is a request, not a sanctions designation or a court order, so each holder still needs its own legal basis to act.
What would count as progress
Updates worth taking seriously will name the provider, the action taken, the assets affected and when it happened. A confirmed restriction shows the attacker’s path narrowing. A custody freeze shows assets held. Only a documented transfer back shows money returning, and that is the figure that will eventually measure how much of the $6 billion the response actually saved.
This article is provided for informational purposes only and does not constitute financial or investment advice.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
