# FBI asks THORChain node operators, RPC providers and DeFi services to refuse transactions tied to the Binance thieves

The request lists Bitcoin, Ethereum and Solana addresses, but Chainalysis says the attackers already use thousands of addresses, and President Trump said the United States would "talk to" North Korea if it was responsible.

- Published: 2026-11-01T05:46:52.612Z
- Canonical: https://polylog.news/crypto/2026-11-01/fbi-asks-thorchain-node-operators-rpc-providers-and-defi-ser
- Publisher: Polylog (Crypto desk)
- Section: geopolitics
- Sources: [CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses), [Polylog editors](https://polylog.news), [Securities.io](https://www.securities.io/fbi-names-north-koreas-tradertraitor-in-6-billion-plus-binance-theft/)

The FBI's October 31 alert does more than attribute the theft. It asks the private sector to refuse service. The bureau, the Secret Service and IRS Criminal Investigation urged THORChain node operators, remote procedure call (RPC) node operators, instant exchanges, decentralized-finance (DeFi) services, blockchain analytics firms and other virtual-asset businesses to [block transactions with or derived from](https://www.securities.io/fbi-names-north-koreas-tradertraitor-in-6-billion-plus-binance-theft/) addresses that TraderTraitor uses to launder the proceeds ([BWE News](https://t.me/BWEnews/16595)). The FBI said it saw the group converting stolen assets into ether and expects "further laundering."

The list covers Bitcoin, Ethereum and Solana addresses. [CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses) reports that the notice names hundreds of addresses, while Chainalysis says the attackers have already used thousands and expects the number to keep growing. Address lists lag the laundering. Each new hop creates fresh addresses that the blocklist does not yet contain.

The request follows the same approach the FBI used in February 2025. After the Bybit theft, the FBI asked for the same kind of blocking, and [THORChain processed much of the laundering anyway](https://www.fxstreet.com/cryptocurrencies/news/fbi-seeks-crypto-industry-help-to-track-block-laundering-of-bybit-hack-funds-202502271126). Reports at the time said THORChain [earned about $3 million in fees within five days](https://itc.ua/en/news/thorchain-protocol-earned-3m-on-bybit-hackers-money-laundering). Services that a company runs, such as RPC providers, stablecoin issuers and front ends linked to analytics firms, can comply within hours. Permissionless protocols depend on operators agreeing to act together, and in 2025 they did not.

The White House response was less direct than the bureau's. Hours after the FBI alert, [President Donald Trump said](https://t.me/BWEnews/16596): "We don't know if it's North Korea but if it is we will talk to them." Washington has little remaining leverage over Pyongyang beyond what it has already used. The United Nations panel that monitored North Korean sanctions evasion lost its mandate in 2024 after a Russian veto, which leaves on-chain freezes and private blocking as the main tools that work in practice.

## What this means

The FBI is turning crypto infrastructure into an enforcement layer. Centralized chokepoints carry most of the exposure: RPC providers, stablecoin issuers, analytics-connected front ends and United States-facing exchanges, which face legal and banking risk if they ignore the list. Permissionless swap protocols face only reputational pressure. North Korea wants to convert the funds into assets nobody can freeze, and it has shown it can do this at scale. Washington can freeze what passes through companies but cannot stop native cross-chain swaps. The precedent is Bybit, where most unfrozen funds were laundered within weeks despite an identical request. The common framing treats the FBI request as a recovery tool. In practice it mostly changes which routes the launderers use. The likelier outcome is that company-run services comply within days, laundering shifts toward bitcoin and permissionless cross-chain routes over the coming weeks, and the episode strengthens the case in Washington for compliance duties on RPC and front-end operators. This read depends on THORChain operators again declining to coordinate. A successful network-level block by those operators would prove it wrong.

## What to watch

- Whether THORChain node operators adopt a coordinated block on the listed addresses. A refusal would repeat the 2025 pattern and invite regulatory attention to the protocol.
- Whether the Treasury Department adds the laundering addresses to its sanctions list. That would turn a voluntary FBI request into a legal obligation for United States persons.
- Any follow-up from the White House on talks with North Korea, which would show whether the theft is being handled as a diplomatic matter or a law-enforcement matter.