The FBI has blamed North Korea's TraderTraitor operation for the Oct. 29 theft of more than $6 billion from Binance. The agency urged THORChain and other service providers to block the identified wallets, while Chainalysis traced how the attackers are working around stablecoin freezes.
The US Federal Bureau of Investigation blamed North Korea's TraderTraitor operation for stealing more than $6 billion from Binance. In an Oct. 31 security alert, the agency attributed the Oct. 29 attack to North Korean cyber actors.
The FBI said investigators working with the US Secret Service and IRS Criminal Investigation had observed the attackers converting stolen assets primarily into Ethereum. It warned that the hackers were expected to move those holdings through decentralized finance (DeFi) protocols and instant swap services to obscure their origins.
FBI publishes wallet addresses and asks operators to block them
To disrupt those efforts, the agency published hundreds of cryptocurrency addresses tied to the theft. It urged THORNode operators, RPC node operators, DeFi platforms, instant exchanges and other service providers to block transactions involving those wallets.
THORChain co-founder Chad Barraford responded that node operators held no information beyond what was publicly available in real time. Barraford wrote: "No subpoenas required, a best case scenario for investigations,"
Attackers use lending protocols to get around freezes
According to Chainalysis, the hackers have used DeFi lending protocols on Tron to circumvent stablecoin freezes, which have already restricted approximately $3 billion in stolen assets. The technique converts TRX into stablecoins, deposits them into lending protocols and returns deposit receipt tokens that stablecoin issuers cannot directly freeze.
The attackers then transfer the receipt tokens to fresh wallets, redeem them for stablecoins and bridge the funds into assets such as ETH. Chainalysis traced approximately $500,000 through this process.
A THORChain glitch briefly halts swaps
Separately, Chainalysis reported that an unrelated technical failure on THORChain disrupted another laundering route. An Ethereum blockchain reorganization led THORChain to mistakenly issue a double refund on a 10 ETH deposit, which triggered an emergency pause on swaps across most of its bridges.
The pause was temporary and indiscriminate rather than a deliberate attempt to block stolen funds. In September, THORChain had rejected calls to block funds linked to Bitget's $388 million hack, arguing that its permissionless architecture prevented selective transaction censorship.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
