North Korean hackers move Binance loot through THORChain as RUNE rises
TraderTraitor uses THORChain after trading restarts
The hackers behind Binance's $6.3 billion heist are using THORChain to launder stolen funds. The source attributes the theft to North Korea's TraderTraitor group.
THORChain is a decentralized exchange, meaning a service where crypto is traded without a central company holding the funds. It can swap assets across different blockchains, which are shared record-keeping systems, without opening an account at a centralized exchange.
RUNE, THORChain's native token, rose 10.6% to $0.637 in the past 24 hours. The rise came as the network resumed cross-chain trading after a halt.
Key numbers from the reported swaps
- RUNE rose 10.6% to $0.637.
- About $48.3 million was swapped through THORChain in an earlier wave, with $42.7 million received.
- That was a loss of roughly 12% to fees and slippage, which means losses from fees and price changes during execution.
- SomaXBT counted 2,697 deposits into THORChain in a Nov. 1 snapshot.
- Interfaces used to submit the swaps earned an estimated $95,000 in affiliate fees, the investigator said.
How investigators describe the latest moves
Lookonchain said the attackers split stolen SOL, which is a crypto token, across wallets. A wallet is an address that holds crypto. They sold it for USDC, a dollar-pegged stablecoin, meaning a token designed to keep a steady value near one dollar, and moved the proceeds to Ethereum.
They then bought ether and swapped it for bitcoin through THORChain. The moves followed an earlier wave of conversions from Tron, according to the source.
In a Nov. 1 analysis, onchain investigator SomaXBT estimated the attackers had swapped about $48.3 million through THORChain and received $42.7 million. Elliptic, a blockchain analytics firm, found repeated swap amounts going into THORChain. A distribution wallet on Tron sent funds hourly for more than a day, and recipient wallets typically forwarded funds within about two minutes.
Why bitcoin and ether matter for freezing funds
Stablecoin issuers can freeze tokens such as USDT and USDC. They have frozen more than $3 billion stolen from Binance, the source said.
Bitcoin and ether have no issuer able to freeze wallet balances. Converting to those assets makes it harder to freeze stolen funds, according to the source.
The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert. It asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving the group's addresses or funds derived from them. Decentralized finance means financial services run on blockchains without a central company.
Trading halt and past use of THORChain
THORChain's operations were interrupted on Oct. 31. An Ethereum block reorganization, which replaces a recently added block, exposed a refund fault. The network paid out 10 ETH that a vault had not received, triggering a trading halt. Chainalysis said the halt also delayed laundering of the stolen funds.
In September, THORChain rejected a Bitget request to block addresses linked to the hacker behind a $388 million breach of that exchange. THORChain said its emergency controls halt broader activity rather than freeze individual swaps. The source says that theft was also attributed to North Korea, and Chainalysis said funds from it commingled onchain with the Binance proceeds. Commingled means the funds were mixed together on the blockchain.
The protocol was also used to move funds stolen from Bybit in 2025. After that hack, THORChain processed a then-record $4.66 billion in swaps in the week ended March 2. Swaps generate fees for the network, while RUNE is paired with assets in its liquidity pools and used to settle trades.
What is confirmed and what remains uncertain
The swaps remain publicly recorded on blockchains. That allows investigators to connect transfers across networks, the source said.
Elliptic said a negligible amount of the Binance proceeds had likely been cashed out. Most activity so far involved moving assets while keeping them in addresses linked to the theft, according to Elliptic.
Binance said Tuesday about $2.85 billion had been frozen. It said it had replenished roughly 98% of the affected tokens with company funds.
What Elliptic expects next
Elliptic expects the attackers to convert more ether into bitcoin in smaller transactions. It expects them to try to cash out through over-the-counter brokers over months. Those businesses allow crypto to be exchanged for payments outside the blockchain, and offer investigators another opportunity to stop the money, according to the source.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
