What to Know

  • North Korea’s TraderTraitor group is using THORChain to route proceeds from Binance’s $6.3 billion heist.
  • RUNE rose 10.6% to $0.637 as THORChain resumed trading on most chains after an Oct. 31 halt.
  • Wallet activity shows stolen SOL being split across wallets, sold for USDC, moved to Ethereum, converted into ether and then swapped for bitcoin through THORChain.
  • An earlier wave of conversions from Tron was also observed, with about $48.3 million swapped through THORChain and $42.7 million received, implying roughly 12% lost to fees and slippage.
  • The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert and asked node operators, DeFi services and crypto businesses to block related transactions.
  • Stablecoin issuers can freeze tokens such as USDT and USDC, while bitcoin and ether do not have issuers that can freeze wallet balances.
  • Binance said Tuesday about $2.85 billion had been frozen and that it had replenished roughly 98% of the affected tokens with company funds.
  • Elliptic expects more ether to be converted into bitcoin in smaller transactions before possible OTC cash-out attempts over months.

RUNE Rallies as THORChain Activity Returns

THORChain’s native token RUNE moved sharply higher as the network resumed cross-chain trading on most chains, with market attention turning to renewed transaction flows tied to the Binance hack. RUNE rose 10.6% to $0.637 after the protocol came back online following an Oct. 31 interruption that had also slowed the laundering path used by wallets linked to North Korea’s TraderTraitor group.

The move highlights the unusual way protocol usage, security events and illicit finance monitoring can collide in decentralized crypto markets. THORChain is designed to let users exchange assets across blockchains without opening an account at a centralized exchange. That structure can be useful for legitimate cross-chain liquidity, but it also means investigators closely monitor the protocol when stolen assets begin moving between networks.

For RUNE, the latest activity has a direct market connection. Swaps on THORChain generate fees, and RUNE is paired with assets in liquidity pools while also being used to settle trades. When large volumes move through the network, traders often reassess the token’s near-term revenue and liquidity dynamics, even when the underlying flows are controversial or linked to criminal activity.

TraderTraitor Wallets Shift Funds Toward Bitcoin

The wallets tied to the Binance breach are now routing funds through a sequence of asset conversions. Onchain tracking shows the attackers splitting stolen SOL across wallets, selling it for the dollar-pegged stablecoin USDC and moving the proceeds to Ethereum. The funds are then used to buy ether, which is swapped for bitcoin through THORChain.

This pattern follows an earlier wave of conversions from Tron. In a Nov. 1 snapshot, onchain investigator SomaXBT estimated that the attackers had swapped about $48.3 million through THORChain and received $42.7 million, losing roughly 12% to fees and slippage. Slippage refers to unfavorable price changes during execution, a risk that can become more significant when large transactions are broken across liquidity pools or routed through volatile market conditions.

The use of bitcoin and ether appears significant because those assets sit outside the issuer-freeze model that applies to many stablecoins. Stablecoin issuers can freeze tokens such as USDT and USDC, and more than $3 billion stolen from Binance has already been frozen. Bitcoin and ether, by contrast, do not have a central issuer able to freeze wallet balances, making them harder targets for direct administrative intervention.

FBI Alert Puts Crypto Businesses on Notice

The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert. The agency asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving the group’s addresses or funds derived from them. That request places service providers and infrastructure participants under renewed pressure to identify tainted funds without the account-based controls used by centralized exchanges.

The situation is particularly challenging for decentralized protocols because transactions can be submitted through different interfaces, wallets and automated systems. THORChain does not function like a conventional exchange with customer accounts and internal compliance review before each trade. Instead, it facilitates cross-chain swaps through protocol infrastructure, which can make selective blocking more complex depending on where in the transaction path controls are applied.

Market participants are also watching how node operators and front-end interfaces respond. Some decentralized finance services can restrict access through websites or applications, but blockchain-level transactions may still be attempted through other routes. That difference between interface controls and protocol-level execution remains one of the core compliance challenges in decentralized finance.

Automation Signals and High-Frequency Movements

Investigators have observed signs of automated transfers in the movement of Binance hack proceeds. Elliptic identified repeated swap amounts moving into THORChain, while a distribution wallet on Tron sent funds hourly for more than a day. Recipient wallets typically forwarded funds within about two minutes, suggesting a highly structured process rather than casual manual transfers.

SomaXBT counted 2,697 deposits into THORChain in the Nov. 1 snapshot. The investigator also said interfaces used to submit the swaps earned an estimated $95,000 in affiliate fees. Those figures underscore the scale and fragmentation of the laundering path, with funds split into many deposits rather than moved in a single, easy-to-isolate transaction.

Fragmentation can serve several purposes in laundering activity. Smaller transactions may reduce market impact, limit slippage on individual swaps and complicate monitoring workflows. At the same time, public blockchains preserve an auditable record, allowing investigators to trace flows across wallets, bridge points and swap routes even when assets move between different chains.

THORChain Halt Delayed the Laundering Flow

THORChain’s operations were interrupted on Oct. 31 after an Ethereum block reorganization exposed a refund fault. A block reorganization replaces a recently added block, and in this case the issue led the network to pay out 10 ETH that a vault had not received. The incident triggered a trading halt, which Chainalysis said also delayed laundering of the stolen funds.

The halt showed how technical disruptions inside decentralized infrastructure can unexpectedly affect both legitimate users and illicit flows. When cross-chain trading pauses, traders lose access to normal swap functions, liquidity providers face uncertainty and any actors relying on the protocol for rapid asset movement may be forced to wait or search for other routes.

After the halt, THORChain resumed trading on most chains, and RUNE’s market reaction reflected renewed expectations for activity through the network. However, the same return of functionality also reopened a path that investigators say had been used by wallets linked to the Binance theft.

Prior Hacks Keep THORChain in the Spotlight

THORChain has been connected to other major post-hack fund movements. After the 2025 Bybit hack, the protocol processed a then-record $4.66 billion in swaps in the week ended March 2. The Binance-linked activity is therefore not the first time THORChain has been scrutinized as a venue for moving stolen assets across chains.

Back in September, THORChain rejected a Bitget request to freeze addresses linked to the hacker behind a $388 million breach of the exchange. The protocol said its emergency controls halt broader activity rather than freeze individual swaps. That theft was also attributed to North Korea, and Chainalysis said funds from it commingled onchain with the Binance proceeds.

This history is central to the current debate around decentralized infrastructure. Protocols designed without centralized custody often lack the same transaction-by-transaction intervention tools available to exchanges. Supporters argue this structure preserves open access and reduces reliance on intermediaries, while critics argue it can create friction for law enforcement when stolen funds are on the move.

Binance Freezes Funds and Replenishes Users

Binance said Tuesday that about $2.85 billion had been frozen and that it had replenished roughly 98% of the affected tokens with company funds. The exchange’s update is a key part of the recovery picture, showing that a large portion of affected assets has been immobilized or covered despite the continued movement of some proceeds through onchain routes.

Freezing funds is most effective where an issuer, custodian or centralized platform can intervene. That is why stablecoins have played a major role in the response. Once proceeds are moved into assets without issuer-level freeze controls, the recovery path can become more dependent on surveillance, exchange cooperation and interception attempts at cash-out points.

Elliptic has assessed that a negligible amount of the Binance proceeds had likely been cashed out so far. Most activity has involved moving assets while keeping them in addresses linked to the theft. That means the laundering process remains visible on public ledgers, even if the assets are being moved through complex cross-chain patterns.

OTC Cash-Out Attempts May Come Over Months

Elliptic expects the attackers to convert more ether into bitcoin in smaller transactions before attempting to cash out through over-the-counter brokers over months. OTC brokers can facilitate crypto-for-payment arrangements outside standard exchange order books, which may appeal to actors trying to avoid the visibility and compliance checks of major trading venues.

Those same OTC routes may also provide investigators with another opportunity to stop the money. Cashing out stolen crypto typically requires interaction with counterparties, liquidity providers or payment channels. Each interaction can create a point where compliance controls, law enforcement outreach or blockchain analytics alerts may disrupt the process.

For the broader market, the episode reinforces the importance of blockchain monitoring, exchange coordination and rapid response from token issuers where freezing tools exist. It also keeps THORChain at the center of a difficult conversation about decentralized liquidity, protocol neutrality and the responsibilities of infrastructure used by both ordinary traders and criminal groups.

Frequently Asked Questions (FAQs)

Why did RUNE rise?

RUNE rose 10.6% to $0.637 as THORChain resumed cross-chain trading on most chains. Traders often watch RUNE closely when THORChain activity increases because swaps generate fees and RUNE is used in liquidity pools and settlement.

What is TraderTraitor?

TraderTraitor is the North Korea-linked group that the FBI attributed to the Oct. 29 Binance theft. The group is now being tracked as it routes stolen funds through cross-chain crypto infrastructure.

How are the Binance hack proceeds being moved?

Onchain activity shows stolen SOL being split across wallets, sold for USDC, moved to Ethereum, converted into ether and then swapped for bitcoin through THORChain. Earlier activity also involved conversions from Tron.

Why does converting into bitcoin and ether matter?

Bitcoin and ether do not have issuers that can freeze wallet balances. That makes them different from stablecoins such as USDT and USDC, where issuers can freeze tokens linked to stolen funds.

How much was swapped through THORChain in the earlier wave?

In a Nov. 1 snapshot, SomaXBT estimated that about $48.3 million was swapped through THORChain and $42.7 million was received, with roughly 12% lost to fees and slippage.

What caused THORChain’s Oct. 31 trading halt?

An Ethereum block reorganization exposed a refund fault, and the network paid out 10 ETH that a vault had not received. The issue triggered a trading halt that also delayed laundering activity.

Has Binance recovered or frozen any funds?

Binance said Tuesday that about $2.85 billion had been frozen and that it had replenished roughly 98% of the affected tokens with company funds.

Have the stolen funds been cashed out?

Elliptic assessed that a negligible amount of the Binance proceeds had likely been cashed out. Most activity so far has involved moving assets while keeping them in addresses linked to the theft.

What could happen next?

Elliptic expects the attackers to convert more ether into bitcoin in smaller transactions before trying to cash out through OTC brokers over months, where investigators may have another opportunity to intervene.