THORChain's RUNE token rose more than 13% on Friday after Binance confirmed a $6.3 billion hack. RUNE climbed to $0.67 from a local low of $0.59, according to TradingView data.
Onchain investigator ZachXBT reported that funds stolen from Binance and September's Bitget hack had passed through THORChain before being combined at the same Ethereum address. The Bitget attack was attributed to North Korea-linked TraderTraitor, with TRM Labs and Chainalysis also linking the Binance hack to the group.
THORChain's Role in Asset Transfers
THORChain is a protocol that allows users to swap assets across blockchains. North Korean hackers previously used the platform to move funds stolen in the $1.4 billion Bybit hack in February 2025, as well as the $388 million Bitget hack.
Protocol Response and Community Concerns
Following the Bitget exploit, Bitget CEO Gracy Chen called on THORChain to block the attacker's addresses, stating that decentralization is a design principle, not a shield for facilitating known stolen funds. THORChain rejected the request, saying it has no mechanism to block individual swaps, though node operators can pause trading for an entire blockchain or across its network to address security risks.
The situation created internal division within THORChain. Core developer Pluto announced his departure after a halt on Ether trading was reversed. Validator TCB threatened to leave unless the protocol stopped processing North Korea-linked funds.
