The FBI Asked THORChain to Block North Korea's Stolen Billions. THORChain Said No.
The FBI has asked the people who run THORChain to stop North Korea's hackers from cashing out, and the answer so far has been no. The agency, along with the Secret Service and IRS Criminal Investigation, published a list of 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address tied to the $6.3 billion Binance theft and asked THORChain node operators, exchanges and DeFi services to refuse transactions connected to them. THORChain is the cross-chain swap protocol that moved a large share of the $1.5 billion Bybit haul in 2025, and the hackers are using it again. About $48 million in stolen funds has already passed through its swaps, according to on-chain tracking, and the token that powers the network is paying the price.
THORChain is not a company with a compliance department, and that is exactly the problem. It is around 100 nodes run by roughly 50 people, and blocking an address would take a vote of more than a third of them. Co-founder Chad Barraford said on X that node operators have "zero information that isn't already public" and made no pledge to block anything. Co-founder JP Thor went further, writing that if node operators took the protocol offline or started filtering transactions because a government asked them to, "the experiment is over." His argument is that THORChain is a neutral settlement layer, and once it stops being neutral for one group it stops being decentralized at all. It is a principled stand, and it is also a stand taken while the network is moving money for the most sanctioned regime on earth.
The market is not waiting for the philosophy debate to settle. RUNE fell about 20 percent over the past day and briefly traded below $0.50, making it the biggest loser in the CoinDesk 100. The selling is not hard to understand. Traders see a protocol caught between two bad outcomes: cooperate with the FBI and give up the permissionless pitch that makes THORChain what it is, or refuse and risk becoming the network that helped a sanctioned regime launder billions. The stakes are not theoretical. Security researcher Taylor Monahan warned node operators on X that the FBI request is a warning shot and that claiming technical inability may not shield them from legal risk, pointing to the Tornado Cash case as the precedent. The FBI has already shown it is willing to go after the people behind supposedly unstoppable code.
Meanwhile the money keeps moving. The hackers have been converting stolen Solana into Bitcoin through the swap service Relay, moving about 486,970 SOL worth roughly $46.4 million, according to blockchain investigators. Other stolen funds reached the centralized exchange Gate, which said it froze two linked accounts. THORChain itself briefly halted swaps after a block reorganization bug, and that accidental pause slowed the hackers down more than any policy decision has so far. As of Sunday afternoon, trading from the Tron chain remained halted, which left a chunk of the loot stuck in place while the debate about what to do next went on without it.
This is the fight crypto has been circling for years, and it finally has a name, a dollar figure and a deadline. THORChain's founders are betting that neutrality is the whole point of the protocol and that giving it up once means giving it up for good. The FBI is betting that the people running the nodes will decide that helping North Korea move $6.3 billion is not the hill to die on. RUNE holders are caught in the middle, watching a token fall while its operators argue about what decentralization is actually for. Whichever side wins, the answer will shape how every decentralized protocol deals with the next hack, and there will be a next hack.
-------
Author: Cedric Holloway, New York Newsroom, GlobalCryptoPress | Breaking Crypto News
















