Stolen Binance funds are moving again, and THORChain fees are rising with them.
Signal Snapshot
- North Korea’s TraderTraitor group is routing Binance hack funds through THORChain again.
- The group is swapping ether for bitcoin after an earlier wave of swaps from Tron.
- RUNE rose about 11% to near $0.64 as trading resumed on most chains.
- THORChain had paused most chains on Oct. 31. That pause also slowed the laundering.
- The Binance theft totaled about $6.3 billion. Little has been cashed out so far.
- Bitcoin sat near $78,000 at the time of writing. It was up about 1% on the day.
Key Takeaways
- Hackers tied to North Korea resumed moving Binance theft funds through THORChain, swapping ether for bitcoin.
- RUNE jumped about 11% as volume and fees returned after the Oct. 31 pause on most chains.
- The real read is simple. Illicit flow can lift short term activity while adding real legal and halt risk.
What Happened
THORChain restarted trading on most chains after an Oct. 31 halt. The restart let normal swaps flow again. It also let the laundering flow resume.
North Korea’s TraderTraitor group is now routing Binance hack funds through the network. The group is swapping ether for bitcoin. That follows an earlier wave of swaps from Tron. The detail comes from Binance hack proceeds moving across chains.
RUNE rose about 11% to near $0.64 on the news. Traders reacted to higher swap activity. More swaps mean more fees for the network. RUNE sits paired with assets in pools. It is also used to settle trades.
The theft behind the flow is huge. Hackers took about $6.3 billion from Binance. That figure makes it one of the largest thefts on record. The laundering path now runs through decentralized swaps on THORChain. That path needs no central issuer to approve each trade.
Moving to bitcoin and ether has a clear goal. It puts funds beyond issuer freezes. Some tokens can be frozen by issuers. Bitcoin and ether cannot be frozen that way. That choice makes tracing harder and seizure harder.
Research firm Elliptic says little has been cashed out. It expects cash outs through private deals over months. That view suggests a slow bleed, not a quick exit. It also means flows could pop up again without warning.
This is not the first time THORChain has seen this pattern. After the 2025 Bybit hack, the network handled about $4.66 billion in swaps in the week ended March 2. That was then a record week. The repeat shows how fast illicit volume can return when trading reopens.
Why It Matters
This is a security event with market impact. Stolen funds are moving through public rails. Price is reacting to that flow. That mix matters for holders and for builders.
Think of THORChain like a currency desk at an airport. Anyone can swap one coin for another. The desk takes a small cut each time. When a big user shows up, the desk gets busy. Fees rise. The house token gets more use.
That is what is happening here. Swaps create fees for the network. RUNE is paired with assets in pools. It helps settle each trade. More swaps mean more demand to use RUNE in the short term. That can lift price even when the reason is ugly.
Second order effects cut the other way. Illicit volume brings heat. Exchanges may flag coins tied to the theft. Stablecoin issuers may watch related addresses. Validators and front ends may face pressure to block flows. That pressure can lead to another halt.
Holders should see both sides. Fees help the network earn. Risk hurts trust and uptime. A chain that pauses often is less useful. A token tied to crime headlines can scare big buyers. Short term pop and long term drag can live together.
For builders, the lesson is plain. Neutral rails still face real world rules. Code may allow any swap. Law still cares who swaps. Teams need clear plans for freezes, pauses, and alerts. Users need to know what a halt means for stuck swaps.
Token Metrics View
Token Metrics data frames this as a bitcoin led tape with a THORChain side show. Bitcoin sat near $78,000. It was up about 1% on the day. It was down about 3% over the past week. Total value stood near $1.57 trillion. That is a heavy, liquid market absorbing a strange news flow.
Daily Pulse listed this as one of its main items. That tag means it cleared the bar for investor attention. It was not background noise. It moved price and raised fresh risk. That matches the RUNE jump and the renewed laundering reports.
Prediction markets add useful context. One Polymarket contract asks if bitcoin will hit $80,000 in November. It was priced near 82%. That level sits about $1,800 above current price. You can see the contract here: bitcoin $80,000 November odds. Traders still lean toward a push higher this month.
A second contract asks if bitcoin will dip to $75,000 in November. It was priced near 64%. That level sits about $3,200 below current price. You can see it here: bitcoin $75,000 dip odds. The two prices together show a tight range view. Upside is favored. Downside is still seen as live.
A third contract asks if bitcoin will dip to $65,000 in November. It was priced near 12%. That level sits about $13,200 below current price. You can see it here: bitcoin $65,000 dip odds. Deep fall risk is priced low. That helps explain why broad market mood stayed calm.
What does that mean for RUNE watchers? Bitcoin calm gives alt flows room to spike on news. RUNE can jump on swap volume while bitcoin drifts. But that jump rests on fragile flow. If THORChain pauses again, volume can vanish fast. If laundering shifts elsewhere, fees can drop just as fast.
Token Metrics technicals are not the story here. Flow is the story. Price follows swaps in this case. Swaps follow access to open chains. Access follows safety and legal calls by operators. Watch chain status first. Watch price second.
Market Context
This story is a security event, not a protocol upgrade. No new feature drove the move. Illicit flow drove it. That matters for how long the move can last.
THORChain lives on the exchanges and settlement rails of crypto. It lets users swap native coins across chains without a central book. That rail is useful in normal times. It is also useful for actors who want to avoid freezes. Both uses run on the same code.
The swap path here is telling. Funds moved from Tron into ether, then into bitcoin. Each hop changes the trail. Tron moves are cheap and fast. Ether adds deep pools. Bitcoin adds the hardest asset to freeze. Step by step, the funds get harder to stop.
The fee angle explains the price pop. Every swap pays. RUNE touches each trade through pools and settlement. When volume jumps, use of RUNE jumps. That link is direct. It does not need hype to work.
The Bybit case from 2025 gives useful scale. That week brought about $4.66 billion in swaps. That was huge for THORChain at the time. It showed that one big actor can fill blocks and fees. It also showed the backlash risk that follows.
Regulators and compliance teams watch these flows closely. They track known hacker addresses. They flag downstream coins. They ask exchanges to freeze deposits. They ask bridge and swap front ends to block access. Each step can cut volume without warning.
Big buyers read this pattern with care. They like fees and real use. They do not like halt risk. They do not like crime ties. A short pop in RUNE does not fix those worries. It may even add to them if headlines persist.
Risks to Watch
Halts
Chains can pause again if pressure builds. A new pause would cut swaps and fees fast.Flags
Exchanges may flag coins tied to the theft. Flagged deposits can be frozen or delayed.Shifts
Hackers can move to other mixers or bridges. A shift would drain THORChain volume quickly.Rules
Each region has its own tests for illicit finance. New guidance could force front ends to block more addresses.
What would make this matter less? A drop in swap volume would do it. If flows move elsewhere, RUNE loses the fee kick. If chains stay open with clean volume, the crime link fades. Then the headline was mostly noise for price.
What to Watch Next
- Watch THORChain chain status pages. Open chains mean swaps can flow. Paused chains mean fees stop.
- Watch swap volume and fee totals. Rising totals confirm the flow is still on THORChain. Falling totals point to a shift.
- Watch researcher alerts from Elliptic and Lookonchain. New address tags often come before exchange flags.
- Watch bitcoin and ether address trails. Moves into fresh wallets can signal the next swap wave.
- Watch for exchange statements on flagged deposits. A freeze notice would show the heat is rising.
This is context, not advice. Do your own homework and expect fast shifts.
Sources / Data Used
- How RUNE moved as hackers resumed Binance loot laundering
- Token Metrics data used: BTC spot price and 24h and 7d moves, market cap, Daily Pulse main items tag, and three Polymarket November contracts.
