THORChain Processed $46M in Stolen Binance Assets in 72 Hours

By Nathan Brooks

More than $46 million in assets stolen from Binance passed through THORChain in the first 72 hours after the theft. Separately, the FBI urged crypto services to stop handling transfers linked to North Korean hackers, while some providers continued processing them.

The bureau attributed the theft of more than $6 billion from Binance to North Korea and asked service providers to block hundreds of linked wallets. It identified the malicious North Korean activity as TraderTraitor.

THORChain also collected more than $200,000 in fees over the same 72-hour period. The measurement window began with the theft, rather than with the FBI's warning, and the available figures do not isolate how many transfers occurred after providers received the bureau's request.

These figures describe different stages of the response. The FBI's figure covers the theft; THORChain's $46 million covers assets handled within 72 hours; and the $200,000 covers fees collected in that window. They are not competing estimates of the original loss.

The fee total adds a commercial dimension: THORChain collected money on the processed volume. The episode therefore reached the service's revenue model, not only the criminal movement of assets.

What does this change for crypto services?

Some developers said they "could not prevent" North Korean hackers from laundering funds through their platforms, a limitation that frustrated law enforcement. That locates the immediate problem in platform controls rather than in the bureau's identification of the linked wallets.

Stopping such transfers is an operational requirement, not merely a policy statement. A platform must recognize a linked wallet, reject the transaction and keep the assets from moving to another service. The developers' account does not establish that every processed transfer was criminal; it shows why an alert does not automatically become a block.

The FBI's request asks services to act on information about hundreds of wallets, yet the continued processing described in the report shows that an alert alone does not guarantee a block. For crypto service operators, the consequence is direct: a law-enforcement warning becomes a test of their screening and transaction-blocking systems.

On the reported scale, THORChain's handling was substantial but still small relative to the overall theft. More than $46 million equals less than 1% of the FBI's stated theft total of more than $6 billion.

That comparison does not establish eventual losses, recoveries or the destination of the assets. It does place the reported THORChain activity below 1% of the total, without implying that most stolen funds moved through the protocol or that the unprocessed balance stayed put.

For users and market participants, the practical consequence is that an FBI warning can arrive while infrastructure remains available for laundering proceeds. The bureau's TraderTraitor designation gives platforms a specific law-enforcement label to screen against, but it does not supply a technical solution. Developers' inability to prevent laundering limits how much weight the warning can carry on its own.

The next test is operational rather than rhetorical: whether services can enforce the FBI's wallet-blocking request before additional transfers settle. No enforcement deadline appears in the report, leaving the enforcement window open for further movement of the linked assets.