RUNE Surges Nearly 9% as Binance Hackers Turn to THORChain

North Korea’s TraderTraitor group, blamed by the FBI for the Oct. 29 theft of $6.3 billion from Binance, has begun laundering part of the loot through THORChain. RUNE gained almost 9% in 24 hours after the network restarted trading across blockchains.

How the Stolen Crypto Is Being Swapped

Lookonchain says the hackers divided stolen SOL among several wallets, sold it for USDC, moved it to Ethereum and bought ether, then exchanged that for bitcoin. SomaXBT estimated $48.3 million went in and $42.7 million came out, a loss of about 12% to fees and slippage, across 2,697 deposits. Elliptic noticed repeated swap amounts and hourly Tron transfers, which points to automation.

Why Freezing Stolen Funds Is Difficult

Stablecoin issuers have locked more than $3 billion. Binance says about $2.85 billion is frozen and it has replaced roughly 98% of the affected tokens from its own funds. Bitcoin and ether, however, have no issuer able to freeze them.

What Investigators Expect Next

Elliptic expects smaller ether to bitcoin conversions, followed by cash outs through over the counter brokers across several months. An Oct. 31 refund fault halted THORChain and, according to Chainalysis, slowed the laundering. Since swaps are public, investigators can still trace them.