Mentioned in This Article
1. North Korea Crypto Hack Proceeds Reach THORChain
The hackers behind the $6.3 billion theft from Binance, identified as North Korea's TraderTraitor group, have started moving the stolen funds through the decentralized exchange THORChain, according to onchain analysts tracking the wallets. As of November 4, the attackers were converting ether into bitcoin, following an earlier wave of conversions that began on the Tron network.
The activity coincided with a price jump for THORChain's native token. RUNE gained nearly 10% over 24 hours, trading at about $0.637, as the network resumed swaps on most of the blockchains it supports following a halt on October 31.
For investigators, the shift matters because bitcoin and ether, unlike dollar stablecoins, cannot be frozen by a company. That makes the choice of THORChain a deliberate step toward assets that are harder to recover.
2. Why Did RUNE Rise While Hackers Used the Network?
RUNE rose because trading volume is what the token is built to capture. THORChain lets users swap assets between different blockchains without opening an account at a centralized exchange, and each swap generates network fees. RUNE sits on the other side of nearly every liquidity pool, paired with the assets being traded, and it is used to settle those trades. More swaps therefore mean more demand for the token and more fee income for the network.
The market has seen this pattern before. After the 2025 Bybit hack, THORChain processed what was then a record $4.66 billion in swaps during the week that ended March 2. The renewed flow of stolen Binance funds, combined with the reopening of most trading routes, appears to have produced a similar surge in activity.
The price move should not be read as an endorsement of the network by traders so much as a reflection of how its fee model works. The same openness that attracts legitimate users, including no account requirement and no central operator deciding who may trade, is what makes the platform attractive to those trying to hide the trail of stolen money.
It is also worth separating network activity from network health. Fee revenue climbs when large volumes pass through the pools, yet a share of that volume in this case comes from funds that law enforcement wants blocked. Participants who provide liquidity or run nodes are therefore weighing the income from additional swaps against the reputational and legal exposure of facilitating them, a tension that surfaced after the Bybit episode and has returned with the Binance case.
3. How the Stolen Funds Are Being Converted
Two separate waves of conversion have been documented. According to the analytics service Lookonchain, the attackers divided stolen Solana (SOL) among a number of wallets and sold it for USDC. They then moved the proceeds onto Ethereum, bought ether (ETH) and swapped that ether for bitcoin (BTC) using THORChain.
The earlier wave began on Tron. An analysis published on November 1 by the onchain investigator SomaXBT estimated that roughly $48.3 million had been put through THORChain and that about $42.7 million had come out the other side. The difference, close to 12%, was lost to fees and slippage, which is the unfavorable price movement that can occur while a trade executes. In other words, the launderers accepted a sizable haircut in exchange for moving into assets that no issuer can block.
The same analysis counted 2,697 separate deposits into THORChain in its snapshot. The interfaces that allowed users to submit those swaps earned an estimated $95,000 in affiliate fees, a reminder that third-party front ends can profit from traffic regardless of where the funds originated.
The cost of this route is itself informative. A loss near 12% on the Tron-origin funds means that for every $100 million routed, about $12 million evaporates before reaching the destination. State-backed groups appear willing to pay that price, which implies that they value distance from freezable assets more than they value the stolen sum in full. It also implies that the later, smaller conversions from ether to bitcoin may be tuned to limit slippage, since thinner pools punish large orders with worse pricing.
4. What Is TraderTraitor and What Did the FBI Say?
TraderTraitor is the name used by U.S. authorities for a North Korean state-linked hacking group that focuses on cryptocurrency companies. In an alert issued on October 31, the FBI attributed the October 29 theft from Binance to the group.
The bureau went a step further than naming a culprit. It asked THORChain node operators, decentralized finance services and other crypto businesses to block transactions involving addresses controlled by the group, as well as any funds derived from them. Because THORChain has no central operator, the request depends on the independent node operators who run the network choosing to act on it.
That limitation has surfaced before. In September, THORChain declined a request from Bitget to block addresses linked to the hacker behind a $388 million breach of that exchange. The project said its emergency controls work by halting broader activity rather than freezing individual swaps. That theft was also attributed to North Korea, and the analytics firm Chainalysis said its funds became commingled onchain with the proceeds of the Binance theft.
The FBI's request also illustrates the gap between a government alert and enforceable control. Law enforcement can publish addresses and ask that they be blocked, but it cannot compel an anonymous set of validators spread across many jurisdictions. Centralized exchanges and stablecoin issuers answer to regulators and courts, and can act within hours; a decentralized swap network moves only when its operators collectively decide to, and the network's own design deliberately makes selective blocking difficult.
5. Why Conversion to Bitcoin and Ether Complicates Recovery
Stablecoin issuers have tools that other assets lack. Tether and Circle can freeze balances in USDT and USDC, and more than $3 billion of the stolen Binance funds has already been frozen in this way. Binance said on Tuesday, November 3, that about $2.85 billion had been frozen, and that it had replenished roughly 98% of the affected tokens using company funds.
Bitcoin and ether offer no equivalent mechanism. No company controls those networks, so once stolen value has been converted into them, the practical options for recovery shrink to tracing the movements and intervening at the point where the money is cashed out into traditional currency.
Analysts at the blockchain intelligence firm Elliptic noted a pattern that points to automation. They observed repeated swaps of identical amounts into THORChain. A distribution wallet on Tron sent funds out every hour for more than a day, and the receiving wallets typically forwarded the money onward within roughly two minutes. Such regularity suggests scripted behavior rather than manual transfers.
This is why issuer freezes have become the first line of defense after large thefts. They work quickly and require no cooperation from the attacker, but their reach ends at the moment the funds leave a freezable token. Attackers know this, and the sequence seen here, selling SOL for USDC, moving to Ethereum, buying ether and then swapping to bitcoin, can be read as a deliberate path out of the zone where intervention is possible.
6. The October 31 Halt and Its Effect on Laundering
THORChain paused trading on October 31 after a technical fault. A block reorganization on Ethereum, in which the network replaces a recently added block, exposed a flaw in how refunds were handled. As a result, the network paid out 10 ETH that one of its vaults had never received, and trading was stopped.
Chainalysis said the pause also delayed the laundering of Binance proceeds. The resumption of swaps on most chains has removed that obstacle, which is consistent with the renewed conversions that analysts have now documented.
The sequence highlights an awkward feature of decentralized infrastructure. A fault unrelated to the hack interrupted the flow of stolen funds, while the restoration of normal service allowed that flow to continue, with no party in a position to distinguish between legitimate and illicit swaps.
Reorganizations of the kind that triggered the halt are a normal feature of proof-of-stake and proof-of-work chains, in which a short-lived version of recent blocks is occasionally replaced by another. Systems that interact with several chains need to handle those events carefully, since a deposit that appears to exist at one moment may vanish in the next. The refund error that paid out 10 ETH shows how a routine event on one network can disrupt a cross-chain protocol.
7. What Do Investigators Expect Next?
Transparency is one advantage investigators retain. Swaps on THORChain are publicly recorded, which lets analysts follow transfers from one network to another and keep attributing wallets to the same actor. Elliptic said that a negligible amount of the Binance proceeds had probably been cashed out so far, and that most of the activity consists of assets being shifted between addresses already linked to the theft.
The firm expects more conversions from ether to bitcoin, carried out in smaller transactions, followed by attempts to turn the funds into cash through over-the-counter brokers over a period of months. Over-the-counter brokers exchange cryptocurrency for payments outside the blockchain, such as bank transfers, and that step gives law enforcement and compliance teams another opportunity to intervene.
For now, the open questions are whether THORChain node operators will respond to the FBI's request, how much of the stolen amount can still be frozen or traced, and how quickly the attackers can move the remainder without being identified at the point of cash-out.
Beyond the immediate pursuit, the episode will likely sharpen debate over how cross-chain protocols should respond to sanctions-linked and state-linked flows. Regulators have repeatedly pressed decentralized services to adopt screening, while developers argue that doing so undermines the neutrality of the software. The coming weeks of onchain data will show whether the laundering proceeds quickly through these routes or slows as the attackers shift to smaller transfers designed to attract less attention.