Source publication: November 8, 2026, at 20:07:42 (UTC+8). This article summarizes TechFlow’s Chinese translation of a Wall Street Journal report by Sam Kessler and Dylan Tokar. Events and relative dates below reflect that report’s publication context.
A reported theft of more than $6 billion from Binance put cross-chain infrastructure and Bitcoin privacy services at the center of a dispute over who must act when stolen assets move through decentralized systems.
According to the report, stablecoin issuers froze approximately half of the stolen funds, but blockchain-tracing firms said nearly $3 billion remained in the hackers’ hands. Transactions linked to the theft continued through THORChain and Wasabi Wallet after the FBI called on cryptocurrency service operators to block related activity.
The FBI attributed the Binance attack to North Korea, which denied involvement.
From exchange custody to cross-chain transfers
Chainalysis said the attackers began moving the stolen assets within minutes, spreading them across more than 10,000 cryptocurrency wallets. The aim was to put the funds beyond the reach of law enforcement and companies capable of freezing assets or intercepting transfers.
Within hours of the theft, stablecoin issuers including Tether and Circle blacklisted associated wallets. That intervention froze approximately half the stolen funds, according to the report. The remaining assets were divided into progressively smaller amounts and moved through different blockchains and mixing services, making the transaction network harder to trace.
Chainalysis reported that, during the first 72 hours after the theft:
- THORChain processed more than $46 million in stolen Binance funds and collected more than $200,000 in fees for those helping operate its infrastructure.
- Nearly $4 million passed through Wasabi Wallet’s Bitcoin mixing functionality.
The report said some of the services involved were operated in part by Americans and continued processing theft-linked transactions despite the FBI’s appeal. That appeal specifically named THORChain node operators.
THORChain: fees, control and disputed responsibility
THORChain enables cryptocurrency swaps between blockchains. Its developers’ position, as presented in the report, was that they either could not intervene in illicit use or should not do so.
In an October 2026 podcast, American co-founder Chad Barraford said the protocol lacked the ability to censor individual transactions or wallets because no such code existed.
Nick Carlsen, a former FBI analyst and senior investigator at TRM Labs, challenged that position. He described THORChain as North Korea’s largest laundering channel and argued that its decentralization claims obscured substantial centralization and profits.
The report also cited an earlier case: after North Korean hackers stole $1.5 billion from Dubai-based exchange Bybit in the preceding year, they conducted nearly $1 billion in transactions through THORChain. Chainalysis said those transactions generated at least $12 million in fees for THORChain operators.
Co-founder John-Paul Thorbjornsen told The Wall Street Journal that blockchain protocols earn fees from usage. He also said he no longer held an active role at THORChain.
A separate lending lawsuit raised questions about administrator powers
Investors in a THORChain-based lending protocol created by Barraford and Thorbjornsen sued the developers in the year before the report. Their complaint alleged that the two controlled a master key functioning as an override switch, challenging the lending protocol’s claims of decentralization. Investors alleged that Thorbjornsen had used the key in an attempt to prevent its collapse.
Barraford denied the investors’ allegations. He did not respond to requests for comment about THORChain’s use in the reported Binance theft.
Thorbjornsen said developers had subsequently removed the administrator key at issue. He said the network was run by 111 nodes, although the number of distinct operators was not disclosed, and argued that it was substantially more decentralized than other protocols.
The lawsuit’s allegations concerned the lending protocol; they were not presented as an established finding that THORChain’s cross-chain transactions could be selectively blocked.
Wasabi: privacy coordination concentrated in one operator
Wasabi Wallet uses a coordinator to help users move Bitcoin without leaving an easily traceable transaction trail. According to a platform tracking the protocol’s activity, a single coordinator handled more than 99% of those transactions at the time of the report.
Chainalysis identified that coordinator as a pseudonymous American Bitcoin developer known as Kruw, and said he earned very little from the work. He did not respond to the report’s recent requests for comment.
During a public appearance in 2024, Kruw described his support for the privacy platform as rooted in anarcho-capitalist libertarian beliefs. Asked about legal exposure, he dismissed politicians’ and regulators’ views while acknowledging that constitutional protections had not always shielded people in such circumstances.
The unresolved regulatory boundary
The report contrasted traditional financial institutions’ obligations to screen for and report potential money laundering with DeFi’s more limited regulatory coverage. It also noted that federal prosecutors had brought cases against some blockchain-service operators accused of knowingly helping criminals launder proceeds, securing convictions in some cases.
Scott Armstrong, a former federal prosecutor and partner at Armstrong & Bradylyons, argued that providing an escape route after exploits and thefts appeared almost integral to some crypto services’ business models.
The central dispute was not simply whether transactions were visible on-chain. It was whether developers, node operators and coordinators had meaningful control over those transactions—and what responsibility followed when they earned fees from activity linked to stolen customer assets. The report presented competing claims on those questions, not a settled legal determination about THORChain or Wasabi.
Original article: TechFlow’s translation of The Wall Street Journal report