North Korea-affiliated hacking outfit TraderTraitor is channeling funds stolen from Binance through the decentralized exchange THORChain, converting ether into bitcoin after previously executing a wave of token swaps originating from Tron.
The native token of THORChain, RUNE, appreciated by roughly 10% within a 24-hour window as cross-chain trading resumed across the network.
These transaction swaps generate fees for the platform, while RUNE is paired with digital assets inside liquidity pools to facilitate trade settlements. Following the 2025 Bybit exploit, THORChain handled a then-unprecedented $4.66 billion in swap volume during the week ending March 2.
In a recent update, Lookonchain reported that the cybercriminals divided the pilfered SOL across multiple wallets, liquidated it into the dollar-pegged stablecoin USDC, and transferred the funds to Ethereum. They subsequently acquired ether and exchanged it for bitcoin utilizing THORChain.
These maneuvers unfold in the wake of an earlier phase of conversions originating from Tron. Within a Nov. 1 assessment, onchain analyst SomaXBT calculated that the perpetrators had routed approximately $48.3 million via THORChain and netted $42.7 million, suffering roughly a 12% loss attributable to transaction fees and slippage, or adverse price fluctuations during execution.
The FBI formally linked TraderTraitor to the Oct. 29 breach via an Oct. 31 warning, urging THORChain node operators, decentralized finance protocols, and other digital asset platforms to block any transactions connected to the group’s addresses or associated capital.
Such asset conversions complicate efforts to freeze the stolen digital currencies. While stablecoin issuers maintain the ability to freeze tokens such as USDT and USDC—having already locked down upwards of $3 billion taken from Binance—neither bitcoin nor ether features an issuing authority capable of freezing specific wallet balances.
THORChain facilitates cross-chain asset exchanges without necessitating registration on a centralized trading platform. The perpetrators behind the Binance security breach have demonstrated automated transfer behaviors, with Elliptic’s investigation revealing consistent swap amounts entering THORChain, alongside a Tron distribution wallet dispatching funds hourly across a span exceeding 24 hours. Destination wallets typically relayed these transfers within a two-minute timeframe.
SomaXBT tallied 2,697 individual deposits into THORChain as of the Nov. 1 data snapshot, with the user interfaces utilized to process the trades generating an estimated $95,000 in affiliate revenue, according to the investigator.
THORChain operations experienced a temporary disruption on Oct. 31 when an Ethereum block reorganization—which rolls back a recently appended block—exposed a refund vulnerability. The network mistakenly distributed 10 ETH that a vault never acquired, forcing a trading suspension that Chainalysis noted also temporarily delayed the laundering of the stolen assets.
Back in September, THORChain denied a Bitget appeal to blacklist addresses tied to the culprit behind a $388 million exploit against that exchange, arguing that emergency protocols shut down broader functions rather than freezing isolated swaps.
That specific breach was likewise connected to North Korean actors, and Chainalysis observed that capital from that incident intermingled onchain with the Binance funds. The protocol was similarly utilized to transfer funds looted during the 2025 Bybit exploit.
Because the trades remain publicly documented on the ledger, investigators can trace transaction paths spanning multiple networks. In its evaluation, Elliptic indicated that only a negligible portion of the Binance proceeds has likely been converted into fiat currency so far. The vast majority of activity has thus far centered on shifting tokens around while retaining them within theft-associated addresses.
Binance reported on Tuesday that approximately $2.85 billion had been frozen and that it had reimbursed roughly 98% of the impacted tokens using corporate reserves.
Elliptic anticipates that the hackers will proceed to funnel additional ether into bitcoin via smaller transactions prior to attempting fiat liquidation through over-the-counter desks over the coming months. These entities, which facilitate cryptocurrency-to-fiat transactions outside standard public ledgers, present investigators with alternative avenues to intercept the funds.
Originally published at https://www.coindesk.com/markets/2026/11/04/thorchain-s-rune-jumps-10-as-north-korean-hackers-resume-laundering-binance-loot.
