THORChain Moved $46 Million From the Binance Hack in 72 Hours and Collected $200,000 in Fees, WSJ Reports

What is new in this report

We have followed the route of these funds since the first days, including an early report of a shared address at Binance, Bitget and THORChain and Elliptic's tally of stolen XRP swapped through THORChain. The Journal's piece adds fee numbers, the first-72-hours total and details on who runs these services.

We could not open the Journal's paywalled text. The figures below come from reports describing it: a ChainCatcher newsflash, a ShiftDelete.Net article and a summary on Financial Crime News Briefs, which names the reporters as Sam Kessler and Dylan Tokar. They agree on every number they share.

Read the 72-hour number carefully

Some headlines say THORChain moved the $46 million after the FBI asked it to stop. The timing in the reports we read does not support that framing in full.

The theft happened on October 29. ShiftDelete says the FBI alert came two days later. The $46 million covers the 72 hours after the theft, so a large part of that window came before the alert, and we could not find a split between the two periods. The reports do say that services kept processing related activity after the appeal. We simply cannot say how many of those dollars moved after it.

The fee numbers are worth a quick calculation. $200,000 on $46 million is about 0.43%. The Bybit figures, at least $12 million on nearly $1 billion, work out to about 1.2%. Both use "more than" or "at least" numbers, so treat them as rough. The arithmetic is ours, and we do not know why the rates differ.

What the FBI asked for

The alert, issued with the Secret Service and IRS Criminal Investigation, attributes the theft to TraderTraitor, the FBI's name for a North Korean group. GovInfoSecurity reports that it names 608 Ethereum addresses, 19 bitcoin addresses and one Solana address. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services, analytics firms and other providers to refuse transactions "with or derived from" those addresses.

North Korea rejected the attribution as a "grave political provocation", CNBC reported, citing state media. We covered that denial in our November 3 report.

THORChain's answer, and the dispute around it

THORChain's founders have made the same argument for days: nobody is in a position to pick and choose transactions.

• Co-founder Chad Barraford wrote on X that node operators have "zero information that isn't already public", according to GovInfoSecurity.
• Co-founder JP Thor wrote that if node operators took the protocol offline, "the experiment is over", the same report says.
• ShiftDelete says Barraford told The Block on November 1 that the official THORChain frontend had blocked the FBI-flagged addresses, but that he expected node operators to "resume trading as normal".

Critics reject that picture. ShiftDelete quotes the Journal's interview with Nick Carlsen, a former FBI analyst now at TRM Labs, who calls THORChain the biggest channel for North Korean laundering and says its decentralization claims mask a centralized, profitable operation.

The Financial Crime News Briefs summary adds two details from the Journal. Investors in a THORChain-based lending protocol previously sued its developers, alleging they had access to a master key, which one co-founder denied. Another co-founder told the paper that the administrative key has since been removed and that 111 nodes now run the network. We have this only through the summary.

Wasabi Wallet is the smaller number with the sharper detail

Nearly $4 million is small against a theft of about $6.3 billion. Bitcoin mixing does something different from a swap, though. It obscures where coins came from. The same summary says a single coordinator handles more than 99% of Wasabi's transactions, and that its American operator, known by the pseudonym Kruw, opposes regulatory intervention. That is a single reported claim from a secondary summary, and we could not verify it independently.

An earlier count was much smaller. CNBC reported that elliptic counted about 28 bitcoin, worth $2.2 million, in 18 mixing transactions as of early November 2. That is an earlier and narrower count than the Journal's, from a different firm, so the two cannot be subtracted to give a growth rate.

How much of the money is still out there

Different firms measure different things at different times, so the totals do not line up neatly.

The gap between $46 million and nearly $3 billion is what readers should keep in mind. On these numbers, THORChain's 72-hour flow is under 2% of what the attackers still hold. TRM also reported on November 3 that the main Ethereum and Bitcoin balances showed no new relevant activity, so most of the stock has not reached a swap venue yet. Those balances may have changed in the six days since.

Elliptic gave CNBC a broader picture of the spread: roughly 12,000 wallets and more than 40,000 transactions across 11 blockchains, in under four days according to GovInfoSecurity. It also said about $786 million in stablecoins was swapped before issuers froze the rest. CNBC reports Elliptic saying only a negligible amount had been cashed out, and that the laundering has moved more slowly than after Bybit, when all the stolen ether moved within 10 days.

Other routes are in play too. TRM describes self-minted tokens on TRON and chained bridges. Bloomberg, carried by The Japan Times, reported on November 6 that Chainalysis saw some of the money moving through Chinese laundering networks.

What this means if you trade or swap

Check before you send. If you use a swap service or receive coins from strangers, look at the FBI's address list and ask where the coins came from. The FBI's wording covers funds "derived from" those addresses, so some services may screen further back than one hop. How far any given exchange looks is not public, and we could not verify a rule for any venue.

If you hold RUNE, separate two questions. The token's market is reacting mildly today, with a 24-hour range of $0.559 to $0.589. That says nothing about whether enforcement will follow. We found no announced US action against THORChain's operators in the sources we read.

If you have a Binance account, follow its status page for your asset. PANews reported on November 9 that Binance Alpha restored withdrawals on four networks, with more to follow in phases. Binance said earlier that it had replaced about 95% of what was taken, GovInfoSecurity reported. ShiftDelete puts the figure at about 98% of affected tokens. We did not reconcile the two. The same GovInfoSecurity report says customers pulled a net $3.64 billion in the first nine and a half hours after withdrawals restarted, about 2.1% of the $171 billion in total assets Binance reported.

Ignore compensation messages. Stories like this one bring out fake "Binance compensation" links and direct messages. We have seen fake payout screenshots during this episode. Use only official channels, and never type a seed phrase into a site you reached from a message.

You can track the wider market's stress on our liquidations page and on funding rates.

What to watch next

Three things would change this story: a US enforcement step against named operators, a new Chainalysis or Elliptic count showing the large ETH and BTC balances moving, and any change by THORChain's node operators to how they treat the listed addresses.

What we could not verify

We read the Wall Street Journal's reporting only through three secondary accounts. Foresight News, which also carried it, returned an error page. We could not open The Block's November 1 report, and the FBI alert page we tried returned a 404, so its contents come through GovInfoSecurity and ShiftDelete. Nobody we read splits the $46 million into before and after the FBI's appeal.