THORChain RUNE Jumps Over 13% After Binance Hack Funds Pass Through the Protocol

THORChain’s RUNE token gained more than 13% on Friday, shortly after Binance confirmed a $6.3 billion hack. TradingView data shows RUNE rising to $0.67 from a local low of $0.59 recorded at 12:20 a.m. UTC. The move came as attention turned to how the stolen money was being shifted across blockchains.

How Stolen Funds Moved Through THORChain

ZachXBT reported that funds taken from Binance and from September’s Bitget hack passed through THORChain before landing at the same Ethereum address. He said the Bitget attack was tied to TraderTraitor, a group linked to North Korea. TRM Labs and Chainalysis have also connected the Binance breach to that group.

North Korea and Past THORChain Laundering Cases

THORChain lets users swap assets between different blockchains, which has made it a repeat route for stolen money. North Korean hackers used it to launder funds from the $1.4 billion Bybit hack in February 2025, and again to move proceeds from the $388 million Bitget hack.

THORChain Refuses to Block Hacker Addresses

After the Bitget exploit, CEO Gracy Chen urged THORChain to block the attacker’s addresses, arguing that decentralization is a design principle and not a shield for handling known stolen funds. THORChain said it has no way to block individual swaps. Node operators can only pause trading for a single blockchain or the whole network when security is at risk.

Internal Split Over Bybit Hack Response

The Bybit hack also divided the community. Core developer Pluto announced his exit after a halt on Ether trading was reversed, and validator TCB threatened to leave unless the protocol stopped processing North Korea linked funds.