North Korea’s TraderTraitor hacking group is increasingly using THORChain to launder cryptocurrency stolen in the $6.3 billion Binance attack, shifting funds from ether into bitcoin after previously routing assets through Tron.
The hackers have resumed cross-chain transactions through THORChain, a decentralized protocol that allows users to exchange digital assets across blockchain networks without relying on centralized exchanges.
THORChain’s native token, RUNE, climbed almost 10% over the past 24 hours as the network restored cross-chain trading. The increased activity generates transaction fees for the protocol, while RUNE is used in its liquidity pools and settlement processes. Following the 2025 Bybit hack, THORChain recorded $4.66 billion in swaps during the week ending March 2.
Lookonchain reported that the attackers were distributing stolen Solana (SOL) among multiple wallets, converting the tokens into USDC and transferring the stablecoins to Ethereum. They then used the funds to purchase ether (ETH) before swapping it for bitcoin (BTC) through THORChain.
The latest activity follows an earlier series of conversions involving Tron-based assets. In a November 1 assessment, blockchain investigator SomaXBT estimated that the hackers had processed roughly $48.3 million through THORChain, receiving approximately $42.7 million. The remaining amount represented an estimated 12% loss from transaction fees and slippage.
The FBI linked the October 29 Binance breach to North Korea’s TraderTraitor group in an October 31 advisory. It called on THORChain node operators, DeFi platforms and other cryptocurrency businesses to restrict transactions involving the group’s identified addresses and funds connected to the attack.
The movement of stolen assets into bitcoin and ether presents additional obstacles for recovery efforts. Stablecoin issuers can freeze tokens such as USDT and USDC, with more than $3 billion connected to the Binance incident reportedly frozen. Bitcoin and ether, by contrast, have no centralized issuer capable of freezing individual wallet balances.
THORChain’s cross-chain infrastructure provides attackers with a way to transfer cryptocurrency between networks without opening accounts on centralized exchanges. Elliptic identified repeated transaction patterns that suggest the hackers were automating the process. Its analysis found that a Tron distribution wallet transferred funds hourly for more than 24 hours, while receiving wallets generally moved the assets again within approximately two minutes.
SomaXBT counted 2,697 deposits into THORChain in its November 1 analysis. The investigator also estimated that the platforms and interfaces facilitating the transactions earned around $95,000 in affiliate fees.
The protocol faced a temporary disruption on October 31 after an Ethereum block reorganization exposed a flaw in its refund mechanism. THORChain mistakenly released 10 ETH that had not reached its vault, forcing the network to pause trading. Chainalysis said the suspension also interrupted the hackers’ laundering process.
THORChain has previously refused requests to selectively block transactions associated with major security breaches. In September, the protocol rejected a request from Bitget to restrict addresses linked to the attacker responsible for the exchange’s $388 million exploit. It explained that its emergency controls were intended to halt wider network operations rather than freeze individual swaps.
That incident was also attributed to North Korean hackers. Chainalysis later reported that cryptocurrency stolen from Bitget had mixed onchain with funds connected to the Binance attack. THORChain was also used to move assets stolen during the 2025 Bybit breach.
Despite the use of multiple blockchain networks, investigators can continue monitoring the transfers because all transactions remain publicly recorded. Elliptic estimated that only a negligible amount of the Binance proceeds had likely been converted into cash. Most of the funds were still being transferred between wallets linked to the original theft.
Binance said Tuesday that it had frozen approximately $2.85 billion associated with the breach and replaced nearly 98% of the affected tokens using company funds.
Elliptic expects the attackers to continue exchanging ether for bitcoin through smaller transactions before attempting to liquidate the assets through over-the-counter (OTC) brokers over the coming months. These intermediaries facilitate cryptocurrency trades outside public exchanges, giving investigators another potential opportunity to trace and disrupt the stolen funds.
