THORChain's RUNE jumps 10% as North Korean hackers resume laundering Binance loot

North Korea's TraderTraitor group is using decentralized exchange THORChain to launder $6.3 billion stolen from Binance, converting ether to bitcoin after an earlier wave of conversions from Tron. The hackers split stolen SOL across wallets, sold it for USDC, moved proceeds to Ethereum, then bought ether and swapped it for bitcoin through THORChain.

THORChain's native token RUNE rose 10.6% to $0.637 as the network resumed cross-chain trading on most chains after an Oct. 31 halt caused by an Ethereum block reorganization that exposed a refund fault. The network paid out 10 ETH that a vault had not received, triggering the trading halt which also delayed the laundering process.

Conversion Strategy

The conversions make it harder to freeze stolen funds, as stablecoin issuers can freeze tokens like USDT and USDC but bitcoin and ether have no issuer able to freeze wallet balances. In a Nov. 1 analysis, investigator SomaXBT estimated the attackers had swapped about $48.3 million through THORChain and received $42.7 million, losing roughly 12% to fees and slippage.

Investigation Response

The FBI attributed the Oct. 29 theft to TraderTraitor in an Oct. 31 alert and asked THORChain node operators, DeFi services and other crypto businesses to block transactions involving the group's addresses. SomaXBT counted 2,697 deposits into THORChain in the Nov. 1 snapshot, with interfaces earning an estimated $95,000 in affiliate fees.

Binance reported about $2.85 billion had been frozen and that it had replenished roughly 98% of the affected tokens with company funds. Elliptic expects the attackers to convert more ether into bitcoin in smaller transactions before attempting to cash out through over-the-counter brokers over months.