Attackers routed assets stolen from Binance through Tornado Cash and decentralized token swaps

Overview Debates Related claims Topics

Cc9f267dcClaimNews event

Israel extradited Israeli-Russian citizen Alexander Block to the United States to face federal charges related to an alleged $2.8 million crypto theft from Nomad

Israeli police arrested Alexander Block at Ben Gurion Airport in May 2025 as he prepared to board a flight to Russia, shortly after he changed his surname from Gurevich and obtained a new passport

Alexander Block allegedly moved tokens worth more than $2.8 million stolen from Nomad through multiple crypto wallets and converted them into other cryptocurrencies to conceal their origin

Hackers drained approximately $6.36 billion from the Binance crypto exchange across 10 blockchains on October 29, 2026

Prosecutors allege that Alexander Block's initial August 2022 exploit exposed Nomad's software flaw to other users, leading to a wider drain of Nomad's funds that emptied over $186 million from a Nomad-controlled wallet

In December 2025, the Federal Trade Commission proposed a settlement requiring Illusory Systems, Nomad's operator, to return recovered funds to unreimbursed users following the $186 million Nomad breach in August 2022

Operating under the username Bitlik around August 1, 2022, Alexander Block allegedly made six test transfers before completing four main transfers to steal over $2.8 million in crypto tokens from Nomad

Binance suspended deposits and withdrawals following the October 29, 2026 Binance hack while stating that user funds remained safe

Blockchain analytics firm TRM linked the October 29, 2026 Binance theft to the North Korean hacking unit TraderTraitor

Nomad recovered approximately $22 million in crypto assets in the days immediately following Alexander Block's August 2022 Nomad exploit

Days after the August 2022 exploit, Alexander Block returned some tokens and contacted a senior Nomad official on Telegram offering to return the rest for a fee before cutting off contact

THORChain's emergency pause mechanism was activated after an Ethereum reorg caused a duplicate 10 ETH refund to be processed, catching the anomaly post-transaction rather than preventing it beforehand

THORChain paused trading and swaps across 12 of the 13 chains it supports after an Ethereum reorganization triggered a double refund error on October 31, 2026

Blockchain analytics firm Chainalysis reported that THORChain's emergency halt temporarily slowed DPRK-linked efforts to launder funds stolen from Binance by freezing cross-chain swaps

Onchain data reviewed by The Block traced approximately $138,000 in stolen crypto funds from the Name.com DNS hijacking attack across EVM-compatible chains routed to three attacker wallets in fixed 15%, 55%, and 30% cuts

The hijacked websites include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, Flap, and Kintsu, while their underlying smart contracts remained unbreached

Hackers hijacked at least 12 decentralized finance websites registered through Name.com in a DNS hijacking attack that rewrote domain records to redirect users to malicious frontend infrastructure

The 12 DeFi websites hijacked through the Name.com DNS attack were injected with Step Drainer, a Malware-as-a-Service toolkit that compromised frontends to harvest unlimited token approvals and signatures across more than 20 blockchain networks

Cloakd, the developer behind FluxBeam, stated on X that its Name.com representative maintained the DNS hijacking incident originated with third-party issuers rather than Name.com itself

On BNB Chain, a Safe wallet flagged by liquidated0x during the Name.com DNS hijacking attack received roughly 3.1 BNB worth approximately $2,200 from four compromised user wallets between 9:00 p.m. and 9:42 p.m. ET on October 30, 2026