THORChain Processed $46 Million in Crypto Tied to $6.3 Billion Binance Heist, Report Says
By Dr. Isabella Gunn · November 9, 2026
Table of contents
- How the stolen Binance funds moved through crypto infrastructure
- THORChain: the cross-chain service at the center of the investigation
- Wasabi Wallet and the difference between privacy and laundering
- Why the FBI's request exposed a problem with decentralized finance
- The FBI's warning did not automatically stop the transfers
- Billions were frozen, but tracing is not the same as recovery
- The laundering operation did not require artificial intelligence
- What the Binance case reveals about accountability in decentralized finance
- Frequently Asked Questions
Blockchain investigators say services including THORChain and Wasabi Wallet helped process cryptocurrency stolen in the $6.3 billion Binance breach, exposing a difficult question for the digital-asset industry: when decentralized platforms facilitate the movement of stolen funds, who has the power — and the responsibility — to intervene?
After attackers drained approximately $6.3 billion from Binance on October 29, 2026, they began splitting the stolen assets across thousands of cryptocurrency wallets and moving them through services designed to exchange, transfer or obscure digital-asset transactions.
An investigation by The Wall Street Journal, citing blockchain analytics firm Chainalysis, identified THORChain as a significant route: it processed more than $46 million in stolen assets during the first 72 hours after the theft, generating more than $200,000 in fees for operators.
Nearly $4 million was also reportedly moved through Wasabi Wallet.
The significance extends beyond the amount processed.
The incident has exposed a structural weakness in cryptocurrency enforcement: blockchain transactions can be publicly traceable, but the services used to move funds do not necessarily operate under a single company with the authority or ability to freeze every transaction.
The FBI attributed the October 29 theft to TraderTraitor, a North Korean state-sponsored hacking group.
It urged cryptocurrency service operators, including THORChain node operators, to block transactions associated with the stolen assets.
Yet transactions continued through services whose developers and supporters argue that decentralized protocols should not censor users.
The dispute is now about more than tracking stolen cryptocurrency.
It concerns the responsibilities of the infrastructure that makes cross-border digital-asset transfers possible.
How the stolen Binance funds moved through crypto infrastructure
The theft began with a compromise of Binance's systems and the unauthorized movement of cryptocurrency from wallets controlled by the exchange.
Binance initially described a compromised laptop as part of the incident, then disclosed that its investigation had uncovered additional points of breach.
The exchange later provided a more detailed account.
According to Binance's November 3 explanation, attackers used a fraudulent recruitment process and malicious software to compromise an engineer's work computer.
They subsequently exploited internal access and wallet-related systems to execute unauthorized transfers.
Once the assets left Binance, the attackers faced a different problem: moving billions of dollars without leaving funds in easily identifiable addresses for too long.
Blockchain networks record transactions on public ledgers.
Investigators can follow transfers between addresses, identify patterns and sometimes associate wallets with known services.
That transparency makes cryptocurrency theft traceable, but it does not automatically make the money recoverable.
Attackers can move assets between blockchains, exchange one token for another, divide balances among many addresses and use services that make the connection between the original source and subsequent transactions more difficult to follow.
Elliptic's investigation estimated that approximately $6.43 billion in cryptoassets was stolen on October 29, with the attacker moving assets across 11 blockchains.
The firm identified extensive use of automated transfers and cross-chain activity as investigators attempted to trace the funds.
The Wall Street Journal's reporting adds an important operational detail: services used to exchange or obscure cryptocurrency became part of the route through which the stolen assets traveled.
THORChain: the cross-chain service at the center of the investigation
THORChain is a decentralized liquidity protocol that allows users to exchange native assets across different blockchain networks.
In practical terms, it provides a way to swap one cryptocurrency for another without relying on a conventional centralized exchange to execute the entire transaction.
Hostinger VPS
Hostinger VPS delivers KVM virtualization, NVMe storage and full root access at prices that undercut most competing cloud providers.
- Strong price to specification ratio overall
- NVMe storage included on every tier
- Renewal rates climb steeply after promo
- Self managed means security is your job
That functionality is useful for legitimate users who want to move between blockchain ecosystems.
It also creates an opportunity for criminals attempting to move stolen assets away from the networks on which investigators first identified them.
Chainalysis, according to the Wall Street Journal, found that THORChain processed more than $46 million connected to the Binance theft during the first 72 hours.
The reported fees exceeded $200,000.
These figures describe the activity attributed to the stolen funds, not the protocol's total transaction volume or overall revenue.
The distinction matters because a cross-chain swap does not necessarily erase the public transaction history.
Investigators can still examine the original transfer, the receiving address and the subsequent movement of assets.
But every additional network and service involved can make attribution, intervention and recovery more complicated.
The FBI's request for THORChain node operators to block transactions linked to the theft brought this tension into focus.
A decentralized protocol may have no single operator with the same control that a centralized exchange has over customer accounts.
Yet the people and organizations maintaining its infrastructure may still have varying degrees of influence over how it functions.
The question is whether that influence is sufficient to prevent the protocol from being used to move known criminal proceeds.
Wasabi Wallet and the difference between privacy and laundering
Another service identified in the reporting is Wasabi Wallet.
Wasabi is a Bitcoin wallet known for privacy features, including CoinJoin.
CoinJoin is a transaction-coordination technique in which multiple users combine their bitcoin inputs and outputs into a single collaborative transaction.
The purpose is to make it more difficult for outside observers to establish which output belongs to which participant.
This is different from simply transferring bitcoin between two addresses.
By combining transactions, CoinJoin can reduce the clarity of the relationship between individual inputs and outputs on the public blockchain.
The Wall Street Journal reported that nearly $4 million connected to the Binance theft was mixed through Wasabi Wallet.
That figure should not be confused with the total value of transactions processed by the wallet or proof that every Wasabi user was involved in criminal activity.
Privacy tools have legitimate uses.
Individuals and businesses may not want their financial activity to be easily mapped by competitors, data brokers or strangers examining public blockchain records.
The same privacy characteristics, however, can be attractive to criminals seeking to complicate the tracing of stolen assets.
This creates a difficult policy question: how can authorities target criminal use without treating financial privacy itself as evidence of wrongdoing?
It is also important to distinguish the software's developers, the operators of any associated infrastructure and individual users.
Their roles and ability to intervene are not necessarily the same.
Why the FBI's request exposed a problem with decentralized finance
The FBI attributed the Binance theft to North Korea's TraderTraitor group and called on cryptocurrency services to prevent transactions involving the stolen assets.
Elliptic's analysis also identified North Korea as the likely source of the attack before the FBI's public attribution.
For a centralized exchange, responding to such a request can be relatively straightforward.
A company that controls customer accounts and custody systems may be able to suspend withdrawals, freeze an account or refuse a transaction, subject to its legal obligations and technical capabilities.
Decentralized services operate differently.
A protocol may rely on independent node operators, smart contracts and distributed liquidity rather than a single company processing every transaction.
A software developer can publish code without necessarily controlling every instance of that code running across a network.
That architecture complicates the question of responsibility.
If a service is used to process stolen assets, authorities may want the people maintaining it to intervene.
Developers may argue that they cannot unilaterally prevent transactions without changing the protocol's design or exercising control that its decentralized structure is intended to avoid.
The Wall Street Journal reported that THORChain and Wasabi developers disputed the idea that their decentralized services should censor users.
Critics, meanwhile, argue that some projects exercise more administrative control than their public descriptions of decentralization suggest.
The report also revisited allegations that THORChain founders retained administrative control, which they dispute.
This is not merely a philosophical disagreement.
It affects whether investigators can identify a responsible party, whether a service can block specific addresses and whether its operators can be held accountable when criminal transactions pass through its infrastructure.
Decentralization is not a single technical condition that automatically removes all control.
The actual powers available to developers, node operators, governance participants and infrastructure providers need to be assessed separately.
The FBI's warning did not automatically stop the transfers
On October 31, the FBI publicly attributed the theft to North Korea and identified the operation as TraderTraitor.
Its advisory specifically called on private-sector organizations, including THORNode operators, remote procedure call (RPC) node operators, instant exchanges, decentralized finance services and other virtual-asset service providers, to block transactions involving addresses associated with the laundering operation.
The advisory matters because it identifies the infrastructure authorities believe can help interrupt the movement of the funds.
An RPC node, for example, provides applications with access to blockchain data and network functions.
An exchange or swap service can facilitate the conversion of one digital asset into another.
A decentralized finance protocol may coordinate transactions through smart contracts and independent operators.
Hostinger VPS
Hostinger VPS delivers KVM virtualization, NVMe storage and full root access at prices that undercut most competing cloud providers.
- Strong price to specification ratio overall
- NVMe storage included on every tier
- Renewal rates climb steeply after promo
- Self managed means security is your job
But an FBI request is not the same as a universal technical shutdown order.
Different services have different control mechanisms, jurisdictions and legal obligations.
Some can freeze assets or reject transactions; others may have limited ability to intervene once a transaction has been authorized and submitted to a blockchain.
The Wall Street Journal reported that transactions continued through services after the FBI's appeal, illustrating the gap between identifying suspicious addresses and preventing every subsequent movement.
The distinction is especially important for assets that have already moved through multiple networks.
A service may be able to block a particular transaction or address without being able to recover funds that have already been transferred elsewhere.
Billions were frozen, but tracing is not the same as recovery
The response from the cryptocurrency industry has produced substantial results, although the figures describe different stages of the recovery process.
Binance's November 3 incident update said approximately $2.85 billion in digital assets had been frozen or intercepted.
The exchange also said it had replenished 98% of the affected token assets using its own resources, with the remaining assets being purchased through market and over-the-counter channels.
Its November 4 recovery update maintained the 98% figure and said the outstanding tokens were less liquid.
These numbers should not be conflated.
Frozen or intercepted funds are assets that investigators or industry participants have prevented from moving freely, subject to the details of each intervention.
Replenished assets are replacement tokens Binance says it has acquired to cover the impact on users.
Stolen assets still controlled by attackers are funds that have not been recovered or effectively immobilized.
Binance's replenishment commitment means customers are not expected to bear the financial loss, according to the exchange.
It does not mean that all the original stolen cryptocurrency has been recovered or that the attackers have lost control of every remaining wallet.
Elliptic's earlier analysis estimated that approximately $2.85 billion, or 44% of the stolen assets, had been frozen or seized.
A subsequent CoinDesk report on Elliptic's investigation said approximately $3.28 billion remained under the attackers' control across more than 950 wallets.
Those are investigation estimates, not a final law-enforcement accounting.
The difference between replacing a customer's balance and recovering the original funds is central to understanding the financial outcome.
Binance can use its own reserves to restore customer holdings while investigators continue trying to locate and immobilize the stolen assets.
The laundering operation did not require artificial intelligence
The Binance incident has also generated questions about whether AI was used to coordinate the movement of the stolen cryptocurrency.
The answer, based on the available blockchain investigation, is that there is no confirmed evidence that AI directed the laundering operation.
Elliptic examined thousands of transfers, repeated transactions and failed swaps.
Its analysis found behavior consistent with automated scripts executing predefined instructions, rather than clear evidence of autonomous AI agents making decisions.
The firm noted that the attackers reused transaction amounts and tested routes with smaller transfers before moving larger sums.
That distinction matters because automation and artificial intelligence are not interchangeable.
A script can execute a sequence of transfers, repeat an instruction or interact with a blockchain service according to rules written by an operator.
An AI agent, by contrast, can use a model to interpret information and select actions dynamically.
The existence of thousands of automated transactions does not establish that an AI system planned or controlled them.
There is a separate, confirmed AI-related element in Binance's account of the original intrusion: the exchange said attackers accessed internal systems using compromised employee devices and an internal AI tool.
That concerns the breach and access to wallet infrastructure, not proof that AI was used to launder the proceeds afterward.
What the Binance case reveals about accountability in decentralized finance
The services identified in the investigation are not interchangeable.
THORChain facilitates cross-chain swaps; Wasabi Wallet provides Bitcoin privacy functionality.
Their technical designs, operators and potential intervention mechanisms differ.
Grouping them all under the label of cryptocurrency laundering services would obscure the actual issue.
The more difficult question is how much responsibility should fall on infrastructure providers when their technology is used to process funds that investigators have publicly identified as stolen.
There are three competing interests.
Law enforcement wants intervention. When investigators identify wallets associated with a major theft, they want exchanges, node operators, bridge providers and other services to prevent the funds from moving further.
Decentralized developers want to preserve protocol neutrality. Some argue that giving developers or operators the power to selectively block transactions creates centralized control, potentially affecting legitimate users and weakening the principles behind permissionless networks.
Users need predictable protections. People using decentralized services for legitimate financial activity need confidence that their transactions will not be arbitrarily censored, while the wider industry needs safeguards against infrastructure being exploited by organized cybercriminals.
Hostinger VPS
Hostinger VPS delivers KVM virtualization, NVMe storage and full root access at prices that undercut most competing cloud providers.
- Strong price to specification ratio overall
- NVMe storage included on every tier
- Renewal rates climb steeply after promo
- Self managed means security is your job
The Binance theft makes the conflict concrete because the amounts involved are enormous and the FBI has publicly identified the alleged perpetrators.
It also demonstrates that blockchain transparency alone cannot guarantee intervention.
Investigators may see where assets are moving without having a direct mechanism to stop every transaction.
For regulators, the case raises questions about which participants exercise meaningful control over decentralized services, what obligations apply to them and how those obligations should be enforced across jurisdictions.
Those questions cannot be resolved simply by describing a project as decentralized or centralized.
They require examining who operates the infrastructure, who can change its behavior and who benefits financially from its activity.
For cryptocurrency companies, the incident is another reminder that security does not end when a wallet is compromised or an unauthorized withdrawal is detected.
The subsequent movement of stolen assets can involve an international network of services, developers, liquidity providers and blockchain operators.
The central lesson is that recovering cryptocurrency requires more than tracing transactions.
It requires cooperation from the infrastructure through which the money moves — and a clearer understanding of where technical control and legal responsibility actually sit.
- The $46 million THORChain figure and nearly $4 million Wasabi figure are attributed to Chainalysis through The Wall Street Journal. They are not independently calculated in this article.
- The reported activity does not establish that the developers of either service personally directed or knowingly participated in the theft.
- THORChain and Wasabi have different technical architectures. Their inclusion in the same investigation should not imply that they provide identical services or have identical powers to block transactions.
- The FBI's attribution to North Korea is an official government assessment. It should not be described as a judicial finding.
- Binance's 98% replenishment figure is the exchange's own reported recovery commitment, not proof that 98% of the original stolen assets were recovered.
- The latest detailed figures used here are from Binance's November 4 update and Elliptic's published analysis. The exact amount still controlled by attackers may change as further transactions are identified or assets are frozen.
