The FBI has urged THORChain’s operators to intervene against North Korean hackers attempting to cash out stolen funds, but their response has been negative. In a coordinated effort with the Secret Service and IRS Criminal Investigation, they disclosed a list comprising 608 Ethereum addresses, 19 Bitcoin addresses, and a single Solana address connected to the $6.3 billion theft from Binance. The agencies requested that THORChain node operators, along with exchanges and DeFi platforms, refrain from processing transactions linked to these addresses. THORChain, known for facilitating cross-chain swaps, played a significant role in the $1.5 billion Bybit theft in 2025, and these hackers are utilizing its services once again. Recent tracking indicates that approximately $48 million in stolen assets has already transited through its platform, affecting the value of the network’s token.
THORChain does not operate like a traditional company with a compliance team, which complicates matters. The network consists of about 100 nodes managed by around 50 individuals, meaning that blocking an address requires a consensus from over a third of them. Co-founder Chad Barraford stated on X that node operators possess “zero information beyond what is publicly accessible” and made no commitment to prevent transactions. His co-founder, JP Thor, emphasized that taking the protocol offline or filtering transactions upon government requests would undermine the entire essence of the project, insisting that THORChain serves as a neutral settlement layer. His viewpoint argues that losing neutrality for any particular group would compromise the decentralized nature of the platform, demonstrating a principled stance, even while the network facilitates transactions for one of the world’s most sanctioned regimes.
The market, however, isn’t pausing for philosophical discussions. The value of RUNE has dropped by approximately 20 percent within a day, briefly falling below $0.50, making it the leading decliner in the CoinDesk 100. The reasoning behind the downturn is apparent. Traders perceive THORChain as being caught between two unfavorable scenarios: either comply with the FBI, sacrificing the ethos of permissionless operations, or resist, potentially becoming a platform that aided a sanctioned regime in laundering billions. The implications are not merely theoretical. Security analyst Taylor Monahan alerted node operators on X that the FBI’s request serves as a warning, and claiming a lack of technical capability might not offer them legal protection, referencing the Tornado Cash situation as a precedent. The FBI has already indicated a willingness to target individuals behind code that is supposedly unstoppable.
Meanwhile, the movement of funds continues. The hackers have reportedly been exchanging stolen Solana for Bitcoin via the Relay swap service, converting about 486,970 SOL valued at around $46.4 million, per blockchain analysts. Additional stolen assets have made their way to the centralized exchange Gate, which has stated that it froze two related accounts. Just recently, THORChain momentarily paused swaps due to a bug associated with block reorganization, inadvertently hindering the hackers more than any policy change could. As of Sunday afternoon, swaps from the Tron chain remained halted, leaving a portion of the stolen funds frozen while discussions on the future course of action continued without resolution.
This ongoing struggle represents a longstanding issue within the cryptocurrency sector, now clearly defined with a monetary figure and a pressing deadline. The founders of THORChain are banking on the idea that maintaining neutrality is fundamental to the protocol’s integrity, suggesting that relinquishing it even once would mean permanently conceding it. On the other hand, the FBI believes that the node operators will conclude that facilitating North Korea’s laundering of $6.3 billion is not worth the risk. RUNE holders find themselves in the midst of this conflict, witnessing the token’s decline while its leaders debate the fundamental purpose of decentralization. The outcome of this clash will significantly influence how decentralized protocols respond to future security breaches, and rest assured, there will be future breaches.
——-
Author: Cedric Holloway, New York Newsroom, GlobalCryptoPress | Breaking Crypto News