coindesk.com
The hackers behind Binance’s $6.3 billion heist, North Korea’s TraderTraitor group, are now using decentralized exchange THORChain to launder the funds.
THORChain’s native token, $RUNE, rose nearly 10% over the past 24 hours as the network resumed cross-chain trading.
Swaps generate fees for the network, while $RUNE is paired with assets in its liquidity pools and used to settle trades. After the 2025 Bybit hack, THORChain processed a then-record $4.66 billion in swaps in the week ended March 2.
In its latest update, Lookonchain said the attackers were splitting stolen SOL across wallets, selling it for the dollar-pegged stablecoin $USDC and moving the proceeds to Ethereum. They then bought ether and swapped it for bitcoin through THORChain.
The moves come after an earlier wave of conversions from Tron. In a Nov. 1 analysis, onchain investigator SomaXBT estimated the attackers had swapped about $48.3 million through THORChain and received $42.7 million, losing roughly 12% to fees and slippage, or unfavorable price changes during execution.
The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert and asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving the group’s addresses or funds derived from them.
The conversions make it harder to freeze stolen funds. Stablecoin issuers can freeze tokens such as USDT and $USDC, and have frozen more than $3 billion stolen from Binance, but bitcoin and ether have no issuer able to freeze wallet balances.
THORChain provides a way to exchange assets across blockchains without opening an account at a centralized exchange. The hackers behind the Binance breach have shown signs of automated transfer, with an analysis from Elliptic finding repeated swap amounts going into THORChain, while a distribution wallet on Tron sent funds hourly for more than a day. Recipient wallets typically forwarded funds within about two minutes.
SomaXBT counted 2,697 deposits into THORChain in the Nov. 1 snapshot, and interfaces used to submit the swaps earned an estimated $95,000 in affiliate fees, the investigator said.
THORChain’s operations were interrupted on Oct. 31 when an Ethereum block reorganization, which replaces a recently added block, exposed a refund fault. The network paid out 10 ETH that a vault had not received, triggering a trading halt, which Chainalysis said also delayed laundering of the stolen funds.
