North Korean Hackers Resume Binance Loot Laundering, Sending RUNE Up 10%

North Korea’s TraderTraitor hackers are moving cryptocurrency stolen from the $6.3 billion Binance breach through THORChain, exchanging ether for bitcoin in an effort to obscure the trail of the stolen funds.

The group has turned to the decentralized exchange protocol to facilitate cross-chain transactions, following an earlier series of conversions involving the Tron network.

THORChain’s native cryptocurrency, RUNE, gained nearly 10% in the past 24 hours as the protocol resumed cross-chain swap services. Increased trading activity generates fees for the network, while RUNE supports liquidity pools and transaction settlement. The protocol previously processed a record $4.66 billion in swaps during the week ending March 2, 2025, after the Bybit hack.

Onchain analytics platform Lookonchain reported that the attackers were spreading stolen Solana (SOL) across multiple wallets before converting the tokens into USDC. The funds were subsequently transferred to Ethereum, where the hackers purchased ether (ETH) and exchanged it for bitcoin (BTC) using THORChain.

The latest transfers follow an earlier round of laundering through Tron. According to blockchain investigator SomaXBT, the attackers had exchanged approximately $48.3 million through THORChain as of November 1, ultimately receiving around $42.7 million. This represented an estimated 12% loss from network fees and slippage.

The FBI confirmed on October 31 that North Korea’s TraderTraitor group was behind the October 29 Binance exploit. The agency urged THORChain operators, DeFi services and other cryptocurrency businesses to block transactions involving the hackers’ identified addresses or assets originating from the attack.

Converting the stolen funds into bitcoin and ether makes recovery more difficult. Stablecoin issuers can freeze tokens such as USDT and USDC, and authorities have already frozen more than $3 billion connected to the Binance incident. Bitcoin and ether, however, operate without centralized issuers capable of freezing individual wallet balances.

THORChain enables direct cryptocurrency exchanges between separate blockchain networks without requiring users to access centralized trading platforms. Elliptic’s investigation uncovered transaction patterns indicating that the attackers were using automated processes to move the funds. One Tron-based distribution wallet reportedly transferred assets every hour for more than 24 hours, while recipient wallets typically forwarded the cryptocurrency within approximately two minutes.

SomaXBT’s November 1 assessment identified 2,697 deposits into THORChain. The investigator also estimated that interfaces facilitating the transactions generated roughly $95,000 in affiliate fees.

The protocol’s operations were temporarily disrupted on October 31 after an Ethereum block reorganization exposed a weakness in its refund mechanism. THORChain mistakenly released 10 ETH that had not arrived in its vault, forcing the network to suspend trading. Chainalysis said the interruption also delayed the hackers’ laundering activities.

THORChain has previously resisted pressure to block individual suspicious transactions. In September, it rejected a request from cryptocurrency exchange Bitget to restrict wallet addresses connected to the attacker behind its $388 million breach. The protocol maintained that its emergency controls were designed to suspend network-wide activity rather than selectively freeze individual swaps.

The Bitget attack was also attributed to North Korea, and Chainalysis later identified onchain links between its stolen funds and the proceeds from the Binance breach. THORChain had likewise been used to move cryptocurrency stolen during the 2025 Bybit exploit.

Although the attackers are distributing assets across multiple networks, blockchain investigators can still follow the transfers through publicly available transaction records. Elliptic estimated that only a negligible portion of the Binance proceeds had been converted into cash so far. Most of the activity involved transferring cryptocurrency between wallets while retaining control of the stolen assets.

Binance said Tuesday that approximately $2.85 billion linked to the incident had been frozen. The exchange also reported replacing roughly 98% of the affected tokens using its own funds.

Elliptic expects the hackers to continue breaking their ether-to-bitcoin conversions into smaller transactions before attempting to cash out through over-the-counter (OTC) brokers over the coming months. These brokers facilitate cryptocurrency trades outside public exchanges and could provide investigators with further opportunities to identify and intercept the stolen funds.