THORChain founder pushes back on FBI’s Binance hack request

THORChain founder JP Thor has urged the protocol's node operators not to follow an FBI request to block transactions tied to North Korean hackers who stole more than $6 billion from Binance. He said shutting the network down would end the project's founding experiment. "IMO if THORNodes decided to take the protocol offline next week then the experiment is over," he said, according to Cointelegraph. "The last bastion of unencumbered and neutral settlement is over. There will simply be no other venue and the protocol would have failed." Thor says he is no longer involved in running the protocol.cointelegraph.com

The dispute makes THORChain a test case for a long-running question in crypto: whether permissionless infrastructure should stay neutral when stolen funds pass through it.

The FBI's request

On Saturday, Oct. 31, the FBI blamed North Korean activity it calls "TraderTraitor" for the Oct. 29 theft. The bureau said it had seen the hackers converting stolen assets mainly into Ether Ethereum ↘ 1.06%, and it expected further laundering through DeFi and instant-swap services. Working with the Secret Service and IRS Criminal Investigation, the FBI published 608 Ethereum addresses, 19 Bitcoin ↘ 2.06% addresses and one Solana ↘ 2.85% address. It asked THORNode operators, RPC providers and DeFi platforms to block transactions involving those addresses, as well as funds that came from them, ForkLog reported. The request was voluntary, not a court order, according to Bitcoin.com News.news.bitcoin.com+2

THORChain has no way to block a single swap, sender or recipient. Node operators can only pause a chain or the whole network, which hits all users, TokenPost reported. A halt needs a vote from one third of operators plus one, and the protocol can keep running with as few as four nodes, Cointelegraph noted. Developer Chad Barraford said about 50 people run its 100 nodes. Barraford also pointed out that all relevant data is already public, calling it "No subpoenas required, a best-case scenario for investigations," per Bitcoin.com News.tokenpost.com+2

A halt for unrelated reasons

Separately, THORChain stopped swaps on most of its connected chains on Oct. 31, including Bitcoin, Ethereum and Tron ↗ 2.75%. The trigger was an Ethereum block reorganization that caused a 10 ETH double refund. Chainalysis said the pause "inadvertently" delayed the laundering of a large share of the stolen funds. Before the halt, THORChain had paid out 17,019 ETH to 170 addresses, CryptoTicker reported. The protocol's RUNE THORChain ↘ 0.36% token had risen 13% on expectations of fees from hack-related swaps, according to BitKE.cryptoticker.io+2

Laundering moves to other routes

The hackers have since started swapping stolen Solana tokens for Bitcoin through the cross-chain service Relay, after largely emptying their holding wallets on Tron, Cointelegraph reported Monday. Industry partners including Tether and Circle ↘ 0.63% have frozen about $3 billion of the stolen assets, and the attackers may still control about $3.5 billion. The exchange Gate said it froze two linked accounts.tradingview.com

BitKE said the standoff raises questions about the legal risk for node operators who keep processing funds from a state-sponsored theft.bitcoinke.io