FBI asks THORChain to block Binance hack funds, testing DeFi limits

Following a $6.3 billion hack on Binance attributed to North Korea-linked group TraderTraitor, the FBI requested THORChain node operators block affiliated wallet addresses. However, THORChain technical co-founder Chad Barraford noted that independent node operators control network swaps beyond the main website frontend. Meanwhile, an unrelated Ethereum block reorganization forced THORChain to suspend trading across 10 connected chains on November 1, 2026, as Binance faced $4.72 billion in net withdrawals.

FBI request and THORChain governance response

• ▪Blockchain researcher Taylor Monahan argued that THORChain network operators possess the technical ability to halt suspicious transaction routes to prevent illicit cross-chain flows
• ▪THORChain technical co-founder Chad Barraford stated that reaching the two-thirds node supermajority consensus required to halt suspicious network routes linked to the $6.3 billion Binance hack takes days or weeks
• ▪On October 31, 2026, the FBI asked THORChain node operators and decentralized finance services to block transactions linked to a roughly $6.3 billion Binance hack that occurred on October 29, 2026
• ▪THORChain technical co-founder Chad Barraford stated that while THORChain's official website blocked FBI-listed addresses, independent node operators control network trading and can accept transactions through other interfaces

FBI wallet identification and omissions

• ▪The FBI omitted Tron blockchain addresses from its list of flagged wallets despite Tron being widely used to move funds stolen in the October 29, 2026 Binance hack
• ▪The FBI attributed the October 29, 2026 Binance theft to TraderTraitor, a North Korean state-linked hacking operation, and identified 608 Ethereum, 19 Bitcoin, and one Solana address used by the attackers

Estimated Cross-Chain fund transfers

• ▪Analyst SomaXBT estimated that transfers of funds stolen in the October 29, 2026 Binance hack included nearly $48 million through Relay, $44 million through THORChain, $32.1 million through Chainflip, and $16 million through Symbiosis
• ▪Analyst SomaXBT estimated that around $242 million of funds stolen in the October 29, 2026 Binance hack moved via the Tron blockchain in two days, including $140 million transferred through cross-chain services like Relay, THORChain, Chainflip, and Symbiosis

Ethereum block reorg triggers THORChain trading halt

• ▪On October 31, 2026, an Ethereum block reorganization triggered THORChain solvency checks after 10 ETH were refunded, leading operators to suspend trading on 10 of 13 connected blockchains on November 1, 2026
• ▪THORChain node operators prolonged a network trading break following an October 31, 2026 Ethereum block reorganization to maintain network solvency rather than to carry out the FBI's blocking request