Binance theft tops $6 billion as FBI urges network operators to block transactions

Key Facts

The U.S. Federal Bureau of Investigation attributed the theft of digital assets worth more than $6 billion from Binance to activity by the North Korean group TraderTraitor, saying the incident occurred on or about October 29. The bureau, together with the Secret Service and the Internal Revenue Service, urged THORNode operators, RPC node operators, instant-swap and decentralized finance services, and digital-asset service providers to block transactions linked to the group’s addresses or derived from them. The FBI said the group was converting the stolen assets mainly into Ethereum and might later turn to decentralized finance and instant-swap services to continue laundering the funds. Elliptic estimated the stolen assets at about $6.43 billion, above the lower bound cited by the FBI. The Associated Press described the incident as the largest recorded cryptocurrency theft and said its value exceeded $6 billion.

Elliptic data showed that observed fund flows changed between snapshots on October 31. In an update at 08:11 UTC, the company said about $25 million had entered THORChain, at a rate of roughly 100 swaps every two hours since midnight. In a later snapshot at 22:41, the total funds tracked to the network had risen to $31 million. The table at the same time recorded $5.3 million through SunSwap, $1.8 million through Bitget Swap and $0.4 million through USDT0. THORChain therefore led the routes listed in that table by observed value, while the figures reflect two different timestamps rather than a single reading of activity.

In a separate route, on-chain analyst SomaXBT estimated that about $242 million of the stolen funds moved through the Tron network over two days through November 1. The Block reported that about $194 million of that amount exited through bridges and swap services, while THORChain handled about $44 million in outflows. That places the network among several channels used to move funds between different chains and services, alongside the routes Elliptic identified in its updates. These remain estimates attributed to the analyst as reported by the outlet, not the total funds that have passed through THORChain since the hack. The FBI said it expects decentralized finance and instant-swap services to be used in subsequent laundering, linking its call to block transactions directly to these transfer routes.

But the network’s ability to respond to the FBI’s request is constrained by its design. THORChain’s third-quarter report said the network has no mechanism to block a specific swap, sender or recipient because it is decentralized and open. This distinction separates the bureau’s call for service operators to block transactions tied to specified addresses from THORChain’s protocol-level ability to prevent an individual swap. The Block reported that the network had not said whether it would block the addresses listed by the FBI. It also quoted co-founder and chief technology officer Chad Barraford as saying node operators do not have non-public information. The bureau’s request, by itself, did not confirm that the parties contacted had acted on it or that the group’s addresses had been blocked.

In a separate operational development, THORChain had halted trading on 10 of its 13 connected chains as of 1:20 p.m. ET on November 1, according to node data cited by The Block. Chainalysis said a reorganization on Ethereum led to a double refund of a 10 ETH deposit, triggering an emergency halt. The pause came as flows linked to the hack were moving through Tron and swap services, but it does not establish that the halt was carried out in response to the FBI’s request. THORChain’s report says operators can halt a chain or the entire network when solvency is at risk, although that does not provide selective blocking of a single swap. The report did not say the emergency halt amounted to a decision to block TraderTraitor addresses.

On losses, Elliptic said it had verified on-chain the freezing or seizure of $2.85 billion, out of a total stolen amount it estimates at $6.43 billion. It said stablecoins account for 94% of the frozen funds, while none of the stolen assets on Bitcoin, XRP Ledger, Solana or NEAR had been frozen because issuers have no authority to freeze native assets on those networks. In an October 31 update, Binance said loss coverage had reached 90% and that it would continue buying the remaining tokens from the market and through over-the-counter trading until coverage reached 100%. The platform said it would absorb the financial impact rather than pass it on to users. Compensation totals differ from funds frozen or seized: the former represents coverage from Binance, while the latter refers to assets Elliptic said it had verified as frozen or seized.

THORChain recorded heavy activity before the incident: its report said trading volume reached $3.82 billion and fees $5.77 million in the third quarter of 2026, nearly double their second-quarter levels. Trading volume in September alone reached $2.41 billion, and the report linked some of the activity to funds from the Bitget platform hack passing through the network. This provides context on THORChain’s capacity to handle large cross-chain flows, but does not link the Bitget incident to the Binance theft. In markets, Bitcoin fell on October 30 to a six-week low of $76,368, while Ether dropped more than 3% to a two-month low of $2,178 before the market stabilized, according to Reuters. Binance announced on November 1 that it had begun resuming withdrawals in phases after suspending them as a precaution to complete security checks and restore affected services.