North Korea’s TraderTraitor hackers are increasingly relying on THORChain to launder cryptocurrency stolen in the $6.3 billion Binance breach, converting ether into bitcoin after previously moving funds through the Tron network.
The hacking group has expanded its cross-chain laundering activity through THORChain, a decentralized protocol that allows cryptocurrency transfers between different blockchains without centralized exchange services.
THORChain’s native token, RUNE, climbed nearly 10% in 24 hours as the network resumed cross-chain swaps. Increased transaction activity can generate additional protocol fees, while RUNE plays a role in liquidity pools and trade settlement. Following the 2025 Bybit exploit, THORChain handled a record $4.66 billion in swaps during the week ending March 2.
Blockchain tracker Lookonchain reported that the attackers were distributing stolen Solana (SOL) across multiple wallets, exchanging the tokens for USDC and transferring the stablecoins to Ethereum. They then purchased ether (ETH) and swapped it for bitcoin (BTC) through THORChain.
The latest transactions follow an earlier laundering phase involving funds transferred from Tron. On November 1, blockchain investigator SomaXBT estimated that approximately $48.3 million had passed through THORChain, with the hackers receiving around $42.7 million. Transaction costs and slippage accounted for an estimated 12% loss.
The FBI identified North Korea’s TraderTraitor group as responsible for the October 29 Binance attack in an October 31 security alert. It urged THORChain validators, DeFi platforms and other cryptocurrency businesses to prevent transactions involving the group’s wallet addresses and funds connected to the exploit.
The use of multiple blockchain networks complicates efforts to recover the stolen assets. Centralized stablecoin issuers can freeze tokens such as USDT and USDC, and more than $3 billion linked to the Binance incident has reportedly been frozen. Bitcoin and ether, however, lack centralized issuers with the authority to block individual wallet balances.
THORChain has become a significant route for cross-chain transfers because users can exchange digital assets without opening accounts on centralized exchanges. Elliptic identified repeated swap amounts and automated transfer patterns associated with the Binance hackers. Its analysis also found that a Tron distribution wallet sent funds hourly for more than 24 hours, with receiving wallets generally forwarding the assets within roughly two minutes.
SomaXBT recorded 2,697 deposits into THORChain in its November 1 assessment. The investigator estimated that interfaces used to execute the swaps generated approximately $95,000 in affiliate revenue.
THORChain’s laundering activity was briefly disrupted on October 31 after an Ethereum block reorganization exposed a flaw in its refund system. The network incorrectly released 10 ETH that had not reached its vault, prompting a temporary trading suspension. Chainalysis said the interruption also delayed the movement of the stolen Binance funds.
The protocol has previously refused requests to selectively block suspicious transactions. In September, THORChain rejected a request from Bitget to restrict addresses associated with the attacker behind the exchange’s $388 million breach. The protocol explained that its emergency mechanisms were designed to halt broader network operations rather than freeze individual swaps.
The Bitget incident was also linked to North Korea. Chainalysis reported that funds from that exploit had mixed onchain with proceeds from the Binance breach. THORChain was also used to transfer assets stolen in the 2025 Bybit attack.
Although cross-chain swaps make tracking more complicated, the transactions remain publicly visible. Elliptic estimated that only a negligible amount of the Binance proceeds had likely been cashed out so far. Most of the activity involved transferring assets between wallets while retaining control of funds linked to the original theft.
Binance said Tuesday that it had frozen approximately $2.85 billion connected to the breach and replenished roughly 98% of the affected tokens using company funds.
Looking ahead, Elliptic expects the hackers to continue converting ether into bitcoin through smaller transactions before attempting to cash out through over-the-counter brokers over the coming months. These intermediaries facilitate cryptocurrency trades outside traditional exchange platforms and could offer investigators further opportunities to trace and disrupt the stolen funds.
