Here is what is confirmed from FBI and on-chain firms:$TRUMP $ESPORTS $IDOL
*The hack:*
- Oct 29, ∼20:05 UTC, $6.3-6.36B drained from Binance hot wallets across 10 chains in about 20 minutes. TRM Labs breakdown: Ethereum $3.79B, Bitcoin $1.47B (18,270 BTC), Tron $628M, XRP $296M, Solana $96M, rest on Arbitrum, Avalanche, Optimism, Base, Polygon.
- Cause looks like compromised delegated permissions via EIP-7702 — attackers got Binance's own signing pipeline to sign attacker-deployed code. Similar to Bybit earlier this year.
- This is now the biggest crypto hack ever — 4x the $1.5B Bybit hack in Feb 2025.
*The attribution in 1 day:*
- On Oct 31, FBI + Secret Service + IRS-CI issued a joint alert attributing it to *TraderTraitor*, the DPRK state-sponsored group tracked as part of Lazarus/APT38.
- It was fast — faster than Bybit (5 days) — because the laundering overlapped. ZachXBT and Chainalysis found Binance funds commingled with $387.5M from the Bitget hack on Sept 24 at the same address on THORChain, same actor.
- FBI published a blocklist: *608 Ethereum addresses, 19 Bitcoin, 1 Solana*. No Tron addresses, even though ∼$242M has already moved through Tron in the last 2 days according to analyst SomaXBT.
*The FBI -> THORChain part:*
You got it right. The alert is unusually specific — it directly names:
> "THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using"
THORChain previously told:
- *Kelp DAO* ($292M in April): ignored
- *Bybit* ($1.5B): used heavily, protocol earned ∼$3M in fees
- *Bitget* ($387.5M, Sept): CEO Gracy Chen publicly asked to block. THORChain replied Sept 28: "A halt is not a selective freeze of specific funds. THORChain is permissionless and doesn't censor by design. Decentralized and permissionless like Bitcoin."
*The hack:*
- Oct 29, ∼20:05 UTC, $6.3-6.36B drained from Binance hot wallets across 10 chains in about 20 minutes. TRM Labs breakdown: Ethereum $3.79B, Bitcoin $1.47B (18,270 BTC), Tron $628M, XRP $296M, Solana $96M, rest on Arbitrum, Avalanche, Optimism, Base, Polygon.
- Cause looks like compromised delegated permissions via EIP-7702 — attackers got Binance's own signing pipeline to sign attacker-deployed code. Similar to Bybit earlier this year.
- This is now the biggest crypto hack ever — 4x the $1.5B Bybit hack in Feb 2025.
*The attribution in 1 day:*
- On Oct 31, FBI + Secret Service + IRS-CI issued a joint alert attributing it to *TraderTraitor*, the DPRK state-sponsored group tracked as part of Lazarus/APT38.
- It was fast — faster than Bybit (5 days) — because the laundering overlapped. ZachXBT and Chainalysis found Binance funds commingled with $387.5M from the Bitget hack on Sept 24 at the same address on THORChain, same actor.
- FBI published a blocklist: *608 Ethereum addresses, 19 Bitcoin, 1 Solana*. No Tron addresses, even though ∼$242M has already moved through Tron in the last 2 days according to analyst SomaXBT.
*The FBI -> THORChain part:*
You got it right. The alert is unusually specific — it directly names:
> "THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using"
THORChain previously told:
- *Kelp DAO* ($292M in April): ignored
- *Bybit* ($1.5B): used heavily, protocol earned ∼$3M in fees
- *Bitget* ($387.5M, Sept): CEO Gracy Chen publicly asked to block. THORChain replied Sept 28: "A halt is not a selective freeze of specific funds. THORChain is permissionless and doesn't censor by design. Decentralized and permissionless like Bitcoin."
