North Korean hackers resume laundering Binance's stolen billions through THORChain as RUNE rises 10%

North Korea's TraderTraitor group has resumed moving proceeds of last month's Binance hack through THORChain, the cross-chain swap protocol, CoinDesk reported Nov. 4, citing on-chain investigators. The protocol's native token, RUNE, rose 10.6% over 24 hours to $0.637 as THORChain resumed trading on most chains following an Oct. 31 halt that also stalled the laundering.

The underlying theft — roughly $6.3 billion — was attributed by the FBI to TraderTraitor in an Oct. 31 alert covering a theft dated Oct. 29. The bureau asked THORChain node operators, DeFi services and other crypto businesses to block transactions tied to the group's addresses. According to blockchain-analytics firm Lookonchain, the attackers split stolen SOL across wallets, sold it for USDC, moved the proceeds to Ethereum, bought ether, then swapped it into bitcoin via THORChain — after an earlier round of conversions from Tron. The point of converting into bitcoin and ether is that neither has an issuer able to freeze wallet balances, unlike stablecoins such as USDT and USDC.

Figures on the laundering come from individual on-chain investigators, not audited data. In a Nov. 1 analysis, SomaXBT estimated the attackers had routed about $48.3 million through THORChain and received roughly $42.7 million, a ~12% loss to fees and slippage, across 2,697 deposits; the swap interfaces used earned an estimated $95,000 in affiliate fees. Elliptic assessed that a negligible amount has actually been cashed out so far, and expects the group to convert more ether into bitcoin in smaller amounts before attempting OTC cash-outs "over months."

Key facts

• RUNE +10.6% to $0.637 over 24 hours as THORChain resumed trading — CoinDesk, Nov. 4.
• Binance heist ~$6.3 billion; FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert.
• ~$48.3M swapped through THORChain, ~$42.7M received (~12% lost), 2,697 deposits, ~$95,000 in interface affiliate fees — SomaXBT, Nov. 1.
• Binance said Tuesday ~$2.85B had been frozen and that it replenished ~98% of affected tokens with company funds; stablecoin issuers have frozen more than $3B of the proceeds — CoinDesk.
• THORChain halted Oct. 31 after an Ethereum block reorg exposed a refund fault, paying out 10 ETH a vault never received — Chainalysis said this also delayed the laundering.

The real-world read

RUNE goes up precisely because the network is being used to launder a nation-state's stolen billions — swap volume generates fees, and THORChain processed a then-record $4.66 billion the week after 2025's Bybit hack. The protocol has leaned on a distinction it reiterated in September, when it rejected a Bitget freeze request tied to a $388 million theft: its emergency controls halt broad activity rather than freeze individual swaps. That framing conveniently leaves stolen-fund flows running. Note also the numbers here lean on pseudonymous investigators (SomaXBT) alongside firms like Elliptic and Chainalysis — directionally corroborated, but single-sourced on the specifics. And "frozen" totals vary by who's counting: Binance claims ~$2.85B, stablecoin issuers more than $3B.

This is news coverage, not financial advice.

Sources

• CoinDesk (Tier 2, secondary) — primary account of the RUNE move, the halt, and the laundering; in turn citing the FBI (Oct. 31 attribution), Elliptic (cash-out assessment), Lookonchain and SomaXBT (swap mechanics and figures), Chainalysis (halt/delay), and Binance (freeze and replenishment claims). Binance's and THORChain's own statements are interested-party claims.