The Federal Bureau of Investigation has confirmed that North Korea was behind the theft of more than $6 billion from Binance. In its October 31 announcement, the bureau attributed the attack to activity it tracks as TraderTraitor, settling the question of North Korean responsibility that had hung over the case.

Why the Request Goes to Infrastructure

The FBI, the Secret Service and IRS Criminal Investigation asked THORNode operators, RPC operators, instant exchanges, DeFi services, analytics firms and other virtual-asset providers to block transactions linked to the addresses they published. According to the agencies, the stolen assets are being converted mainly into ETH, and further laundering is expected to run through DeFi and instant-swap services.

That conversion explains why the request reaches so many types of service. Stablecoin issuers can freeze their own tokens, and part of the haul was frozen that way within hours. ETH has no issuer to call. Once the attacker moved value into ETH, stopping it depends on the services the funds pass through next.

The address list is the starting point. The FBI describes the listed wallets as holding or having previously held stolen assets, and as operated by or closely connected to TraderTraitor actors. Some may already be empty. Each provider still has to work out what, if anything, it can do within its own role.

Five Things “Blocking” Can Mean

Intervention runs from the weakest form of action to the strongest, and only the last rung puts money back:

1. Tracing. Analytics firms map where funds move and alert others — information, not control.
2. Refusing a connection. An RPC provider or app interface turns away requests from flagged addresses on its own service.
3. Halting a protocol. A network such as THORChain can pause trading or a whole chain, stopping everyone’s transactions, not just the attacker’s.
4. Freezing in custody. An exchange or custodian that holds the assets denies access to them.
5. Returning funds. Identified assets are actually transferred back.

Each rung requires different evidence. A refused connection shows one service said no. A halt shows activity paused, for a time. A custody freeze shows assets held, pending a legal process. Only a return shows recovery. The providers named in the request sit at different rungs: analytics firms trace, RPC operators and app interfaces refuse, protocol operators can halt, and custodians freeze.

Refusing a Connection

Applications reach Ethereum through nodes, often run by RPC providers, to read data or send transactions, as Ethereum’s JSON-RPC documentation explains. A provider can refuse requests that pass through its service, but the network’s rules do not change. Broadcasting, block inclusion and finality are separate stages, and a transaction turned away by one provider can still be sent through another. The same applies to a website that restricts its interface while the underlying protocol keeps running.

Halting a Protocol: THORChain’s Position

The FBI named THORNode operators directly — the operators who run the THORChain network — which puts THORChain’s design under scrutiny. In an October 1 post, published before the Binance theft, the project said its protocol can pause a chain or the whole network for safety but has no control to remove a single swap. Its October 23 quarterly report repeated that position.

The project’s developer documentation describes several kinds of pause, from stopping trading to stopping outbound signing to halting a chain. Any of them would catch every user of that route, not only the attacker.

An accident has already shown what an unplanned interruption looks like. On October 31, Chainalysis said an Ethereum block reorganization caused THORChain to issue a duplicate refund to someone who had deposited 10 ETH, inadvertently delaying the laundering of funds stolen from Binance. That was an operational fault, not a deliberate restriction — and delayed funds are not recovered funds.

THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance. The reason? An Ethereum reorg. One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH. This triggered an “emergency pause” on THORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps. Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.

— Chainalysis (@chainalysis) October 31, 2026 — posted on X

Freezing in Custody

The strongest point of control is a business that actually holds the assets. ETH has no issuer blacklist, but an exchange or custodian holding stolen ETH for a customer can lock that account. Where sanctions apply, OFAC guidance requires a US person holding blocked virtual currency to deny access and meet holding and reporting rules. The FBI’s alert is a request, not a sanctions designation or a court order, so each holder still needs its own legal basis to act.

What Would Count as Progress

Updates worth taking seriously will name the provider, the action taken, the assets affected and when it happened. A confirmed restriction shows the attacker’s path narrowing. A custody freeze shows assets held. Only a documented transfer back shows money returning — and that is the figure that will eventually measure how much of the $6 billion the response actually saved.

This article is provided for informational purposes only and does not constitute financial or investment advice.