Why Binance Exploit Funds Passed Through THORChain
Key Takeaways
- •On-chain investigator ZachXBT reported that funds linked to the Binance exploit moved through THORChain before being consolidated at an Ethereum address also associated with September's $387.5 million Bitget hack, and both incidents have been linked to North Korean hacking operations.
- •THORChain's permissionless, pooled-liquidity architecture enables cross-chain swaps of native assets without centralized approval, and its RUNE token rose following the Binance hack.
- •In the Bitget case, the attacker used THORChain to convert stolen assets into Bitcoin and moved approximately $83 million in stolen XRP, which Ripple cannot freeze because native XRP lacks the address-blacklisting capability that stablecoin issuers like Tether and Circle have.
- •THORChain's refusal to block addresses tied to the Bitget attacker prompted a dispute with Bitget CEO Gracy Chen, who argued decentralization should not shield infrastructure facilitating identifiable stolen funds, while THORChain said its architecture cannot selectively censor transactions.
- •The controversy echoes the February 2025 Bybit hack, when roughly $1.4 billion was laundered through THORChain, triggering contributor disagreements and a subsequent lawsuit by Bybit against North Korea that secured an asset freeze.
Why Binance Exploit Funds Passed Through THORChain
#ThorChain’s $RUNE token up following the #BinanceHack. — BitKE (@BitcoinKE) October 30, 2026
On-chain investigator ZachXBT reported that funds linked to the Binance exploit passed through THORChain before being consolidated at an Ethereum address also associated with September’s $387.5 million Bitget hack. BitKE previously reported on the Binance incident and the movement of funds linked to the Bitget breach.
Both incidents have been linked to North Korean hacking operations. The Bitget exploit, however, illustrated why attackers may use THORChain to move stolen assets across blockchain networks.
THORChain is a decentralized exchange protocol built on pooled liquidity rather than order books, with its RUNE token serving as the settlement asset that connects pools across networks. Its permissionless architecture allows users to swap native assets such as Bitcoin and Ethereum across blockchains without approval from a centralized exchange. Because every swap settles on public blockchains, transfers leave a traceable record even as assets change networks, yet the same structure can make it difficult for platforms to intervene after stolen funds enter the protocol’s liquidity infrastructure. In the Bitget case, the attacker used THORChain to convert stolen assets into Bitcoin while also moving approximately $83 million in stolen XRP across multiple wallets. BitKE reported on the XRP transfers and the use of THORChain to move the stolen funds.
The XRP movements highlighted another limitation in crypto-asset recovery. Ripple cannot freeze native XRP held in attacker-controlled wallets, unlike stablecoin issuers such as Tether and Circle — the issuers of USDT and USDC — which can blacklist certain addresses.
THORChain’s refusal to block addresses associated with the Bitget attacker also triggered a dispute with Bitget CEO Gracy Chen. Chen argued that decentralization should not shield infrastructure facilitating the movement of identifiable stolen funds. THORChain maintained that its architecture does not support selectively censoring individual transactions.
The controversy echoed the February 2025 Bybit hack, when attackers used THORChain to launder approximately $1.4 billion in stolen assets. The incident prompted disagreements among contributors over whether the network should restrict transactions linked to criminal activity. Bybit later sued North Korea and secured an asset freeze.
The latest incident has renewed attention on THORChain’s permissionless cross-chain model, which generates transaction fees from swaps. Increased activity can benefit protocol economics, but hack-related flows do not necessarily represent sustainable organic demand for its services.
The Binance-linked transfers therefore underscore the trade-off at the center of THORChain’s design: its cross-chain functionality can support asset movement without centralized approval, while the same feature can limit the ability of platforms to stop transactions involving identifiable stolen funds.
