The FBI has asked THORChain node operators and other decentralized finance (DeFi) services to block transactions tied to the roughly $6.3 billion stolen in the Binance hack — a request that underscores how difficult enforcement becomes in a network built to run without central control.

The request came on October 31. THORChain is a cross-chain swap network connecting 13 blockchains; its nodes operate independently, and no single authority can compel them to block the transactions.

What the FBI asked for — and how THORChain responded

The bureau attributed the October 29 theft to TraderTraitor, its designation for a North Korean state-linked hacking operation, and asked services to block the wallets it listed along with any transactions derived from them. In its official alert, the FBI said the attackers were converting the stolen crypto into Ether.

So far, the FBI has identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. Notably, it has not listed any address on Tron, even though that blockchain has been widely used to move the stolen funds.

Chad Barraford, THORChain's technical co-founder, told The Block that the protocol's official website has blocked the listed addresses. He noted that node operators can already see transactions on public blockchains, but said he expects the independent operators to continue processing trades as before.

Where the frontend ends and the nodes begin

The distinction between THORChain's website and the THORChain network itself matters here. The website exists to offer a swap interface, but the protocol runs on separate nodes that can be reached through other front ends. That split is common across DeFi, where front ends are optional interfaces and the protocols underneath run on independent operators. Blocking an address on the official site therefore does not stop the same transaction from being executed elsewhere, and it remains unclear whether node operators have blocked the flagged addresses across the network.

A separate halt that caught legitimate users

An unrelated issue then halted trading activity. On October 31, an Ethereum block reorganization prompted THORChain to refund 10 ETH tied to vaults that had not received deposits, and the shortfall was picked up by the network's solvency checker. That forced operators to extend the pause, and on November 1, trading on 10 of the 13 connected chains was suspended. All parties involved suffered losses. The halt was meant to protect the network — not to carry out the FBI's request.

The numbers are estimates, not settled facts

The speed at which the stolen funds have moved has complicated efforts to gauge the total accurately. Analyst SomaXBT estimated in an X post that around $242 million was transferred via the Tron blockchain within two days.

The vast majority of that total — about $140 million — moved through a range of cross-chain services: Relay carried almost $48 million, THORChain moved $44 million, Chainflip transferred $32.1 million, and Symbiosis handled $16 million. These figures are estimates, and they do not suggest that THORChain had any knowledge of the hackers' wrongdoing.

Why wallet-by-wallet screening may not hold

The rapid movement of stolen funds makes screening wallets one at a time difficult. Blockchain analytics firm Elliptic tracked roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days, finding signs of automated laundering but no evidence that AI agents were directing it. With funds continually hopping to new wallets, fixed blocklists can quickly fall behind — and the FBI's 628 identified addresses so far cover only a fraction of that activity.

For THORChain, the question is how quickly it can respond. In an earlier debate, researcher Taylor Monahan argued that the network could halt suspicious routes. Barraford countered that reaching two-thirds node consensus — agreement from a supermajority of operators — could take days or weeks, and that acting faster would require more centralized control.

The stakes for liquidity, compliance and trust

Binance, meanwhile, is working to rebuild customer confidence. The exchange completed a proof of reserves — a snapshot showing whether specified customer balances are backed by assets — and promised to cover the losses.

Even so, Reuters reported $4.72 billion in net withdrawals, about 3% of platform assets, despite $2.7 billion in inflows. Cryptopolitan has previously examined THORChain's exposure to stolen funds.

From here, the markers to watch are concrete: whether THORChain's node operators act on the FBI's list network-wide, whether Tron addresses are added to it, and when trading resumes on the 10 suspended chains. The latest case brings a familiar challenge back into focus: how can DeFi keep liquidity open without compromising compliance and user trust?