THORChain's RUNE Surges 13% After Binance Confirms $6.3 Billion Hack
Key Takeaways
- •RUNE rose more than 13% on Friday to trade at $0.67, recovering from a local low of $0.59, after Binance confirmed a $6.3 billion hack.
- •Onchain investigator ZachXBT reported that stolen funds from both the Binance hack and September's Bitget hack passed through THORChain before being combined at a single Ethereum address.
- •The Bitget attack has been attributed to TraderTraitor, a North Korea-linked group first named in a January 2022 US Treasury, FBI, and CISA advisory and also linked to the Binance hack by TRM Labs and Chainalysis.
- •North Korean hackers previously used THORChain to launder proceeds from the $1.4 billion Bybit hack in February 2025 and the $388 million Bitget hack.
- •THORChain rejected Bitget CEO Gracy Chen's request to block attacker addresses, saying it has no mechanism to stop individual swaps and can only pause trading for entire blockchains, a position that divided its contributors.
THORChain's RUNE token rallied more than 13% on Friday after Binance confirmed a $6.3 billion hack.
RUNE traded at $0.67 at the time of writing, up from a local low of $0.59 hit at 12:20 a.m. UTC, according to TradingView data.
Earlier in the day, onchain investigator ZachXBT reported on X that funds stolen from Binance and from September's Bitget hack had passed through THORChain before being combined at the same Ethereum address.
ZachXBT said the Bitget attack has been attributed to TraderTraitor, a North Korea-linked hacking group. TraderTraitor was first publicly named in a January 2022 advisory from the U.S. Treasury, FBI and CISA, which attributed a set of phishing campaigns against cryptocurrency businesses to North Korean state-sponsored actors; the U.S. Treasury later tied the group to the $100 million Harmony Horizon Bridge theft in June 2022. Blockchain analytics firms TRM Labs and Chainalysis also linked the Binance hack to the same group.
THORChain lets users swap assets across different blockchains, with liquidity pools paired with its native RUNE token. North Korean hackers previously used the protocol to launder proceeds of the $1.4 billion Bybit hack in February 2025, and it was also used to move funds stolen in the $388 million Bitget hack.
After that exploit, Bitget CEO Gracy Chen publicly urged THORChain to block the attacker's addresses, saying, “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
THORChain rejected the request, saying it has no mechanism to block individual swaps. It noted that node operators can pause trading for an entire blockchain or across the network to address security risks.
The Bybit hack also divided THORChain contributors. Core developer Pluto announced his departure after a halt on Ether trading was reversed, while validator TCB threatened to leave unless the protocol stopped processing North Korea-linked funds. The Binance disclosure adds a new data point to that unresolved debate — one in which THORChain has said its only tools are pauses affecting entire blockchains, not individual addresses.
Related: THORChain generates $5M in fees, $5.4B in volume since Bybit hack
