Binance's $6.3 billion hack: What we know and what comes next

After Binance announced a $6.3 billion hack, THORChain's RUNE token surged 13% on Friday. RUNE's value increased from $0.59 to $0.67 at the time of writing, according to TradingView data. Analysts ZachXBT discovered that funds stolen from Binance and the September Bitget hack had both passed through THORChain before being consolidated in the same Ethereum address.

Both TRM Labs and Chainalysis have also attributed the Binance hack to a North Korea-linked group known as TraderTraitor. THORChain is a platform that enables users to swap assets across various blockchains. In the past, North Korean hackers have employed the protocol to launder money stolen in the $1.4 billion Bybit hack in February 2025 and the $388 million Bitget hack.

When Bitget's exploit occurred, CEO Gracy Chen urged THORChain to block the attacker's addresses, emphasizing that decentralization should not serve as a shield for facilitating known stolen funds. However, THORChain declined, stating it lacks the means to block individual swaps. Instead, node operators can pause trading for an entire blockchain or across the network to address security concerns.

Following the Bitget exploit, the Bitget CEO called for THORChain to take action, but the protocol refused, explaining that it has no mechanism to block specific swaps.