RUNE Rises 10% as Hackers Move Binance Loot Through THORChain
The DeFi exchange processed large swaps again as the Binance hackers moved stolen SOL, USDC, ether, and bitcoin. The FBI links the loot to TraderTraitor and is asking for blocks.
Key Takeaways
- THORChain was back in the spotlight after hackers behind the Binance hack moved stolen funds through the network.
- The RUNE token rose nearly 10% in 24 hours as THORChain processed more cross-chain swaps.
- The FBI linked the theft to TraderTraitor and asked crypto companies to block linked transactions.
THORChain was back in the spotlight after the hackers behind the Binance hack of $6.3 billion (€5.6 billion) used the decentralized exchange to move stolen funds. The native token RUNE rose nearly 10% in 24 hours, while the network processed more cross-chain trading again.
New Route for the Loot
According to Lookonchain, the attackers split stolen SOL across multiple wallets, sold it for the dollar-pegged stablecoin USDC, and sent the proceeds to Ethereum. They then bought ether and swapped it through THORChain into bitcoin. Earlier, an initial wave of conversions already ran through Tron, showing that the group is using multiple routes to hide where the funds came from.
These moves make it harder to freeze stolen crypto. Stablecoin issuers can block tokens like USDT and USDC, but bitcoin and ether do not have an issuer that can freeze wallet balances. That is exactly why moving across multiple chains remains so difficult for investigators.
RUNE Benefits From Swaps
THORChain earns fees on swaps, while RUNE sits in the liquidity pools and is used to settle trades. After the Bybit hack in 2025, the network processed a record $4.66 billion (€4.2 billion) in swaps in the week through March 2. That shows why large flows of money, even when they come from a hack, can be visible on the protocol right away.
SomaXBT estimated on November 1 that the attackers had converted about $48.3 million (€43.2 million) through THORChain and received $42.7 million (€38.2 million) for it. That meant a loss of about 12% from fees and slippage, the price differences that happen during execution. Elliptic also found that the swaps remained mostly publicly traceable, with repeated amounts flowing into THORChain and wallets on Tron sometimes forwarding funds within two minutes.
Pressure on the Industry
The FBI linked the October 29 theft to TraderTraitor and asked THORChain node operators, DeFi services, and other crypto companies to block transactions tied to linked addresses. That fits into a broader fight against North Korean cybercrime, which has also been linked before to major attacks on crypto exchanges, including Bybit in 2025.
For European crypto readers, this matters because it shows how quickly stolen funds can move across multiple chains, even when regulators and investigators are already warning about it. THORChain itself also briefly went offline on October 31 after an Ethereum reorganization exposed a refund bug, which once again highlighted how vulnerable this kind of infrastructure can be.