Episode summary
Why the FBI Called Out Thor Node Operators: Uneasy Money
Unchained
· · Hosts: Kain Warwick, Taylor Monahan · Guests: Adam Sadowski
Summary
THORChain briefly double spent during the Binance hack after a one-block Ethereum reorg, then shut down so the team could ship a fix. The discussion argues that the bug itself was serious, but the bigger problem was what happened next: the network had to be updated and restarted while the stolen funds were already moving through the protocol.
Over the weekend, the FBI, IRS-CI, and U.S. Secret Service formally attributed the hack to North Korea’s TraderTraitor and explicitly called out THOR node operators in the guidance on how to help. The speakers say that mattered because it put node operators on notice that the relevant addresses were now sanctioned, creating possible OFAC and criminal-liability exposure if the network kept processing them.
After the update, THOR nodes voted to bring the network back online and continued processing activity involving the flagged addresses. The guest says this led to nearly $200 million in DPRK volume in just a few days, and warns that the case echoes Tornado Cash: builders may think they are powerless, but prosecutors may treat that inaction as a deliberate choice.
Key takeaways
- THORChain’s one-block reorg bug allowed a double spend during the Binance hack, forcing a shutdown and code update.
- The FBI, IRS-CI, and Secret Service formally linked the theft to North Korea’s TraderTraitor and singled out THOR node operators for help.
- The guest says the restart put THORChain in potential OFAC and criminal-liability territory because the network had notice that the addresses were sanctioned.
- The guest says THORChain processed nearly $200 million in DPRK-related volume within a few days after the restart.
- The discussion frames THORChain as a warning shot for DeFi builders, with Tornado Cash cited as the precedent everyone should be watching.
Notable quotes
“Thorchain double spent immediately during the hack”
“they shut down on Friday because of this reorg”
“the FBI, IRS CI, US Secret Service release a formal statement attributing the hack to Trader Trader, which is North Korea”
“they processed transactions that were involving addresses that were explicitly on the FBI's list”
Topics
- thorchain double spend
- binance hack
- fbi attribution tradertraitor
- north korea laundering
- tornado cash parallel
Companies and tickers mentioned
- THORChain
- LlamaRisk
- Tornado Cash
Watch the episode
Watch “Why the FBI Called Out Thor Node Operators: Uneasy Money” on YouTube
Summary, takeaways and quote selection by Octagon. Quotes are short excerpts; the full conversation is in the episode.
More from Unchained
-
Should Ethereum Tax Its Apps to Prove Its Security Is Worth It? -
Ledger and the Metadata Your Hardware Wallet Sends After You Sign - Uneasy Money -
How Institutions Are Thinking About Crypto in an Era of Record Hacks -
Is Ethereum's $240 Billion Market Cap Justified With Only $6 Million in Monthly Fees? -
Jeff Dorman: Why ETH as a Store of Value Doesn't Add Up -
Should Vitalik Leave the Ethereum Pitch to Others? - Uneasy Money
Unchained, this episode and its artwork belong to Laura Shin. Octagon is not affiliated with the show; this page is an independent summary.
