RUNE Surges 10% as North Korean Hackers Resume Moving Stolen Binance Funds

North Korea’s TraderTraitor hacking group is using THORChain to move funds stolen in the $6.3 billion Binance breach, converting ether into bitcoin after previously routing stolen assets through Tron.

The North Korean hackers responsible for the Binance exploit have turned to decentralized exchange protocol THORChain to transfer and launder the stolen cryptocurrency.

THORChain’s native token, RUNE, gained nearly 10% over the past 24 hours as the protocol resumed cross-chain swap operations.

The transactions generate fees for THORChain, while RUNE serves as a trading and settlement asset within its liquidity pools. The protocol previously recorded a weekly swap volume of $4.66 billion in the week ending March 2, 2025, following the Bybit hack.

According to blockchain analytics platform Lookonchain, the attackers have been dividing stolen Solana (SOL) across multiple wallets, exchanging the tokens for USDC before transferring the stablecoins to Ethereum. They subsequently purchased ether (ETH) and converted it into bitcoin (BTC) using THORChain.

This activity follows an earlier series of transactions involving funds moved from Tron. In a November 1 report, onchain investigator SomaXBT estimated that the attackers had processed approximately $48.3 million through THORChain, receiving around $42.7 million in return. The difference represented losses of nearly 12% from transaction fees and slippage caused by price movements during swaps.

The FBI formally linked the October 29 Binance theft to North Korea’s TraderTraitor group in an October 31 advisory. The agency urged THORChain node operators, DeFi platforms and other cryptocurrency businesses to block transactions involving the group’s identified wallet addresses and associated stolen funds.

Moving assets between blockchains makes recovering and freezing the stolen cryptocurrency considerably more difficult. Stablecoin issuers can blacklist and freeze assets such as USDT and USDC. More than $3 billion connected to the Binance theft has reportedly been frozen. However, bitcoin and ether do not have centralized issuers capable of freezing individual wallet balances.

THORChain enables users to exchange cryptocurrencies across different blockchains without relying on centralized exchanges or opening trading accounts. Blockchain analytics firm Elliptic identified patterns suggesting that the Binance attackers were using automated transfers. Its investigation found repeated transaction amounts being routed through THORChain, while a distribution wallet on Tron transferred funds every hour for more than a day. Receiving wallets typically moved the assets again within approximately two minutes.

SomaXBT’s November 1 analysis identified 2,697 deposits into THORChain. The investigator also estimated that the interfaces facilitating these transactions had collected approximately $95,000 in affiliate fees.

However, THORChain experienced an operational disruption on October 31 after an Ethereum blockchain reorganization exposed a vulnerability in its refund mechanism. The network mistakenly released 10 ETH that had never arrived in its vault, forcing developers to suspend trading. According to Chainalysis, the interruption also slowed the hackers’ laundering operations.

The protocol had previously faced criticism in September after rejecting a request from cryptocurrency exchange Bitget to block addresses associated with the attacker behind its $388 million security breach. THORChain explained that its emergency mechanisms were designed to suspend broader network activity rather than selectively freeze individual transactions.

That incident was also attributed to North Korean hackers. Chainalysis subsequently reported that funds associated with the Bitget breach had become mixed onchain with proceeds from the Binance attack. THORChain had also been used to transfer cryptocurrency stolen during the 2025 Bybit exploit.

Despite the cross-chain transfers, investigators can still trace the transactions because blockchain activity remains publicly accessible. Elliptic’s assessment indicated that only a negligible portion of the Binance proceeds had likely been converted into cash. Most of the activity involved moving cryptocurrency between wallets while keeping the assets connected to addresses associated with the theft.

Binance said Tuesday that approximately $2.85 billion in stolen assets had been frozen. The exchange also reported replenishing around 98% of the affected tokens using its own funds.

Elliptic expects the attackers to continue exchanging ether for bitcoin through smaller transactions before attempting to convert the funds into cash through over-the-counter (OTC) brokers over the coming months. These brokers facilitate cryptocurrency transactions outside public exchanges and could provide investigators with additional opportunities to identify and disrupt the movement of the stolen funds.

About The Author

ctleditor

See author's posts