North Korean Hackers Linked to Binance and Bitget Exploits Utilize THORChain
North Korean state-sponsored hacking groups have once again been implicated in major cryptocurrency heists, with evidence suggesting they used the THORChain protocol to launder funds stolen from Binance and Bitget. The revelations have intensified scrutiny on THORChain’s decentralized nature and its role in facilitating illicit financial flows.
THORChain’s native token, RUNE, experienced a notable surge of over 13% on Friday, coinciding with the confirmation of a massive $6.3 billion hack targeting Binance. According to data from TradingView, RUNE climbed to $0.67 at the time of reporting, up from a local low of $0.59 reached at 12:20 a.m. UTC.
Onchain investigator ZachXBT reported Friday that funds siphoned from both the Binance hack and the September Bitget exploit had been routed through THORChain. The investigator noted that these illicit funds were subsequently consolidated at a single Ethereum address. ZachXBT further stated that the Bitget attack has been attributed to the North Korea-linked hacking group TraderTraitor. Both TRM Labs and Chainalysis have also pointed to the same group in connection with the Binance hack.
THORChain is a cross-chain decentralized exchange that enables users to swap digital assets across different blockchains. Previously, North Korean hackers had leveraged the protocol to launder funds stolen in the $1.4 billion Bybit hack in February 2025. The protocol was also utilized to move assets stolen in the $388 million Bitget hack.
Following the Bitget exploit, CEO Gracy Chen publicly urged THORChain to block the attacker’s addresses. Chen stated, “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
THORChain, however, rejected the request, citing a lack of mechanisms to block individual swaps. The protocol’s operators explained that node operators possess the ability to pause trading for an entire blockchain or across the entire network in response to security risks.
The Bybit hack had previously caused internal divisions among THORChain contributors. Core developer Pluto announced his departure after a halt on Ether trading was reversed. Validator TCB also threatened to withdraw its participation unless the protocol ceased processing funds linked to North Korea.
