SKN | THORChain’s RUNE Rallies 10% as North Korean Hackers Resume Moving Binance Stolen Funds

Key Points:

• THORChain’s RUNE token gained approximately 10% as the North Korea-linked TraderTraitor group resumed moving cryptocurrency attributed to the $6.4 billion Binance hack through the cross-chain protocol.
• The attackers are reportedly routing stolen Ether into Bitcoin through THORChain, following an earlier laundering phase that involved moving funds through the Tron network.
• The activity highlights the challenges decentralized finance protocols face in monitoring illicit transactions while maintaining permissionless cross-chain infrastructure.

THORChain’s native token, RUNE, rose approximately 10% on November 4 as North Korea-linked hackers resumed using the protocol to move cryptocurrency stolen in the reported $6.4 billion Binance breach. The renewed activity comes after a temporary disruption to THORChain’s cross-chain swaps and illustrates how the movement of illicit funds can intersect with token-market activity, protocol operations and growing regulatory pressure on decentralized finance.

RUNE Gains as Cross-Chain Activity Resumes

The reported 10% advance in RUNE coincided with renewed laundering activity attributed to TraderTraitor, the North Korean hacking operation identified by the FBI as responsible for the Binance theft. According to CoinDesk, the attackers were routing stolen Ether through THORChain and converting it into Bitcoin, following an earlier phase in which funds were moved through Tron.

The distinction between these networks matters. Cross-chain protocols allow users to exchange assets across different blockchains without relying exclusively on centralized exchanges. That functionality provides legitimate users with greater flexibility, but it can also create additional routes for attackers attempting to move stolen assets between networks and complicate transaction monitoring.

RUNE’s price increase should not be interpreted as evidence that the protocol has benefited fundamentally from the activity. The reported market move occurred alongside renewed transaction activity and heightened attention, but the available reporting does not establish that the laundering directly caused the token’s appreciation.

From Tron Transfers to Ether-to-Bitcoin Conversions

The latest movements follow an earlier laundering campaign involving the Tron network. On November 1, blockchain analyst SomaXBT estimated that approximately $242 million of Binance-related stolen funds had been moved through Tron over two days. Around $44 million of the cross-chain outflows was attributed to THORChain, while other services, including Relay and Chainflip, also handled significant volumes.

The attackers reportedly deposited 185.1 million TRX and 3.83 million USDT into THORChain through thousands of transactions. The protocol subsequently paid out approximately 17,019 ETH and 53.25 BTC to attacker-controlled addresses, according to the analyst’s tracking. These figures demonstrate the scale of the network’s involvement in the earlier phase, although they should not be confused with the total amount stolen from Binance.

The renewed Ether-to-Bitcoin conversions indicate that the laundering operation continues to shift between assets and networks. Bitcoin presents a particular challenge for recovery because it has no central issuer capable of freezing individual coins. Investigators therefore depend heavily on identifying wallets and coordinating with exchanges and other services where funds may eventually arrive.

THORChain’s Operational and Regulatory Challenges

THORChain’s earlier interruption was triggered by a technical issue rather than a deliberate decision to stop the hackers. An Ethereum blockchain reorganization caused the protocol to issue an incorrect double refund involving a 10 ETH deposit, prompting an emergency pause across multiple connected networks. The disruption also temporarily prevented the attackers from using affected cross-chain routes.

By November 3, THORChain had restarted swaps on most networks, including Bitcoin, Ethereum and Tron, although some connections remained paused. The FBI had separately urged THORNode operators, decentralized finance services and other providers to block transactions associated with the stolen assets. This creates a difficult governance question for decentralized protocols: how to respond to law-enforcement requests without undermining their permissionless operating model.

Investor Implications Extend Beyond RUNE

For investors, the episode highlights the difference between increased protocol activity and sustainable economic value. Transaction volumes can rise during periods of unusual market attention, but security incidents may also increase reputational, operational and regulatory risks. The response of node operators, developers and infrastructure providers could therefore have a lasting influence on THORChain’s institutional credibility.

Attention will remain on the volume of stolen assets moving through cross-chain services, the effectiveness of wallet screening and whether additional network restrictions are introduced. RUNE’s rally may reflect renewed market attention, but the longer-term outlook will depend on THORChain’s ability to maintain reliable operations while addressing the risks associated with illicit transactions. The broader DeFi sector faces the same challenge: preserving open financial infrastructure while limiting its use in large-scale laundering operations.