FBI asks THORChain node operators, RPC providers and DeFi services to refuse transactions tied to the Binance thieves

The FBI's October 31 alert does more than attribute the theft. It asks the private sector to refuse service. The bureau, the Secret Service and IRS Criminal Investigation urged THORChain node operators, remote procedure call (RPC) node operators, instant exchanges, decentralized-finance (DeFi) services, blockchain analytics firms and other virtual-asset businesses to block transactions with or derived from addresses that TraderTraitor uses to launder the proceeds (BWE News). The FBI said it saw the group converting stolen assets into ether and expects "further laundering."

The list covers Bitcoin, Ethereum and Solana addresses. CoinDesk reports that the notice names hundreds of addresses, while Chainalysis says the attackers have already used thousands and expects the number to keep growing. Address lists lag the laundering. Each new hop creates fresh addresses that the blocklist does not yet contain.

The request follows the same approach the FBI used in February 2025. After the Bybit theft, the FBI asked for the same kind of blocking, and THORChain processed much of the laundering anyway. Reports at the time said THORChain earned about $3 million in fees within five days. Services that a company runs, such as RPC providers, stablecoin issuers and front ends linked to analytics firms, can comply within hours. Permissionless protocols depend on operators agreeing to act together, and in 2025 they did not.

The White House response was less direct than the bureau's. Hours after the FBI alert, President Donald Trump said: "We don't know if it's North Korea but if it is we will talk to them." Washington has little remaining leverage over Pyongyang beyond what it has already used. The United Nations panel that monitored North Korean sanctions evasion lost its mandate in 2024 after a Russian veto, which leaves on-chain freezes and private blocking as the main tools that work in practice.