EL7.AI
CryptoMedium•1 November 2026•
4 min read

$6.3 Billion Binance Theft Prompts FBI to Urge THORNode Operators to Block Transactions

Key Facts

1The AP estimated that about $6.3 billion in cryptocurrencies was stolen from Binance.
2Elliptic tracked about $31 million entering THORChain through October 31.
3Elliptic verified about $2.85 billion as frozen or seized, equivalent to 44% of its estimated theft value.
4Binance said its partners had frozen about $3 billion on-chain through its October 30 update.

The U.S. Federal Bureau of Investigation, along with the Secret Service and the Internal Revenue Service, asked THORNode operators, RPC node operators, instant-swap platforms and decentralized finance services to block transactions linked to specific addresses following the Binance theft. The FBI said the group known as TraderTraitor converted the stolen assets mainly into Ethereum and that it expects decentralized finance and instant-swap services to be used in later stages of laundering. The Associated Press reported that about $6.3 billion in Bitcoin and other cryptocurrencies was stolen from Binance on Thursday, describing the incident as the largest recorded cryptocurrency theft. Those figures put the flow of funds through decentralized swap services at the center of the investigations, as investigators seek to prevent the assets from being moved to destinations that are difficult to trace. The FBI did not announce that the THORChain network had halted operations or that a technical failure had disrupted transfers, despite an earlier draft's reference to a halt linked to a reorganization on Ethereum.

In an update published on October 31, Elliptic said about $31 million had entered THORChain in total, and activity had reached roughly 100 swaps every two hours since midnight. This tracking offers an indication that the network was used in fund flows linked to the incident, but it does not establish that the network halted swaps or that an outage delayed the laundering of funds. In a table published by the company based on data at 22:41 UTC on October 31, the amount it traced to THORChain was $31 million, compared with about $5.3 million to SunSwap and $1.8 million to Bitget Swap. Elliptic cautioned that the figures could change as tracking continued. The comparison shows that THORChain was the largest of the three routes cited in the table by observed funds.

On asset recovery, Elliptic estimated that on-chain funds it had verified as frozen or seized totaled about $2.85 billion, equivalent to 44% of its estimated theft value, according to the latest update to its article on November 1. In its October 30 update, Binance said its partners had frozen about $3 billion on-chain and that the incident's estimated total impact was about $6.3 billion. Binance also said on Saturday that it had set aside enough of the same cryptocurrency that was stolen to cover 90% of the lost assets, and pledged to fully compensate customers. Freeze figures differ by source, verification methodology and timing: Elliptic's estimate includes funds the company verified, while Binance reported the results of its partners' work through the date of its update. These amounts reflect parallel efforts to reduce losses and recover assets after the hack.

THORChain's use in the fund flow comes as the network recorded elevated activity in the third quarter. THORChain said in its report that the network processed about $3.82 billion in trading volume and generated about $5.77 million in fees in the third quarter of 2026, nearly double second-quarter levels on both measures. The report also said some of the funds stolen in the Bitget hack passed through the network in September. Between September 25 and 29, trading volume reached about $1.38 billion, more than half of September's total. This provides prior context for the network's role in moving assets between different chains, without by itself establishing a link between that incident and the Binance theft.

THORChain says its decentralized, open architecture has no mechanism to block a particular swap, sender or recipient. According to its third-quarter report, operators can halt a chain or the entire network when solvency is at risk, but that differs from blocking specific addresses at the level of an individual swap. The FBI's request is directed at THORNode operators, infrastructure providers and other services; it is not an announcement that the network has implemented a general shutdown. The AP reported that Bitcoin fell 3.2% on Thursday evening, October 29, to below $79,000 during coverage of the incident. It also said Binance temporarily suspended deposits and withdrawals while conducting security checks, freezing funds and working with law enforcement.

The FBI said it expects the stolen assets to be moved later through decentralized finance and instant-swap services, and directed private entities to block transactions linked to published TraderTraitor addresses. The directive remains the next announced step in the response, alongside Binance's announced efforts to freeze funds and compensate customers. The FBI did not set a deadline or subsequent timetable in the alert, nor did it announce a planned halt to the THORChain network. Binance said the suspension of deposits and withdrawals was temporary and would continue during security checks and work with law enforcement. The announced next steps focus on monitoring the specified addresses and preventing transactions linked to them.