THORChain's native RUNE token gained more than 13% on Friday, climbing to approximately $0.67 from a local low of $0.59 earlier in the day. The price movement coincided with reports that cryptocurrency stolen in Binance's record-breaking $6.3 billion security breach had passed through THORChain's protocol.
Binance Breach Details and Investigation Findings
Binance confirmed the security incident and estimated its total impact at $6.3 billion, making it one of the largest cryptocurrency thefts on record. According to the exchange's preliminary investigation, a potentially compromised DevOps engineer's laptop may have allowed attackers to access internal infrastructure and submit unauthorized withdrawal transactions.
On-chain investigators reported that funds connected to both the Binance breach and September's $388 million Bitget hack had passed through THORChain before being consolidated at the same Ethereum address. Blockchain intelligence firms TRM Labs and Chainalysis have linked the Binance attack to North Korean hackers, while the Bitget incident has been attributed to TraderTraitor, a hacking group also linked to North Korea.
THORChain's Cross-Chain Function and Permissionless Design
THORChain enables users to exchange digital assets across different blockchain networks without relying on centralized exchanges. However, its permissionless structure has attracted criticism following reports of stolen cryptocurrency moving through the protocol.
The protocol has been used to move funds connected to multiple major cryptocurrency exploits, including the $1.4 billion Bybit attack in February 2025 and the Bitget incident. When asked to block specific transactions, THORChain rejected the request, explaining that it lacks the technical mechanism to block individual swaps. Node operators can only pause trading on entire blockchains or across the network.
Community Tensions and Governance Challenges
The controversy surrounding THORChain's role in processing stolen funds has created divisions within the community. Following the Bybit incident, core developer Pluto announced his departure after an Ether trading halt was reversed. Validator TCB threatened to leave unless the protocol stopped processing funds linked to North Korean hackers.
Broader Implications for Decentralized Finance
The situation highlights challenges facing decentralized finance platforms. While permissionless infrastructure allows users to move assets freely across blockchain networks, the same openness can make it difficult to prevent stolen funds from passing through these systems.
THORChain's latest exposure renews questions about how decentralized protocols should respond when their infrastructure is used to move assets connected to major cryptocurrency thefts, and whether governance structures can address these concerns without compromising their decentralized model.
