THORChain's RUNE jumps 10% as North Korean hackers resume laundering Binance loot

The hackers behind Binance’s $6.3 billion heist, North Korea’s TraderTraitor group, are now using decentralized exchange THORChain to launder the funds.

THORChain’s native token, RUNE, rose nearly 10% over the past 24 hours as the network resumed cross-chain trading.

Swaps generate fees for the network, while RUNE is paired with assets in its liquidity pools and used to settle trades. After the 2025 Bybit hack, THORChain processed a then-record $4.66 billion in swaps in the week ended March 2.

In its latest update, Lookonchain said the attackers were splitting stolen SOL across wallets, selling it for the dollar-pegged stablecoin USDC and moving the proceeds to Ethereum. They then bought ether and swapped it for bitcoin through THORChain.

The moves come after an earlier wave of conversions from Tron. In a Nov. 1 analysis, onchain investigator SomaXBT estimated the attackers had swapped about $48.3 million through THORChain and received $42.7 million, losing roughly 12% to fees and slippage, or unfavorable price changes during execution.

The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert and asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving the group’s addresses or funds derived from them.

The conversions make it harder to freeze stolen funds. Stablecoin issuers can freeze tokens such as USDT and USDC, and have frozen more than $3 billion stolen from Binance, but bitcoin and ether have no issuer able to freeze wallet balances.

THORChain provides a way to exchange assets across blockchains without opening an account at a centralized exchange. The hackers behind the Binance breach have shown signs of automated transfer, with an analysis from Elliptic finding repeated swap amounts going into THORChain, while a distribution wallet on Tron sent funds hourly for more than a day. Recipient wallets typically forwarded funds within about two minutes.

SomaXBT counted 2,697 deposits into THORChain in the Nov. 1 snapshot, and interfaces used to submit the swaps earned an estimated $95,000 in affiliate fees, the investigator said.

THORChain’s operations were interrupted on Oct. 31 when an Ethereum block reorganization, which replaces a recently added block, exposed a refund fault. The network paid out 10 ETH that a vault had not received, triggering a trading halt, which Chainalysis said also delayed laundering of the stolen funds.

Back in September, THORChain rejected a Bitget request to addresses linked to the hacker behind a $388 million breach of the exchange, saying its emergency controls halt broader activity rather than freeze individual swaps.

That theft was also attributed to North Korea, and Chainalysis said funds from it commingled onchain with the Binance proceedsThe protocol was also used to move funds stolen from Bybit in 2025.

The swaps remain publicly recorded, allowing investigators to connect transfers across networks. In its assessment, Elliptic said a negligible amount of the Binance proceeds had likely been cashed out. Most activity so far involved moving assets while keeping them in addresses linked to the theft.

Binance said Tuesday about $2.85 billion had been frozen and that it had replenished roughly 98% of the affected tokens with company funds.

Elliptic expects the attackers to convert more ether into bitcoin in smaller transactions before trying to cash out through over-the-counter brokers over months. Those businesses, where crypto can be exchanged for payments outside the blockchain, offer investigators another opportunity to stop the money.