thorchain

According to Onchain Lens monitoring, the Binance hacker has transferred or laundered nearly 900 million dollars in funds, out of an estimated total of 6.34 billion dollars in stolen funds: 891.37 million dollars may have been transferred or laundered; 2.85 billion dollars is still under the hacker's control; 2.6 billion dollars has been frozen.In the past 2 to 3 days, the hacker has been actively transferring funds through THORChain and Chainflip.

According to The Wall Street Journal, the Binance hackers immediately launched a large-scale money laundering operation after their heist. According to Chainalysis data, the organization dispersed the funds to over 10,000 cryptocurrency wallets.Some cryptocurrency service providers continued to process transactions related to the theft and charge fees even after the FBI called for a halt. THORChain processed over $46 million in stolen funds within 72 hours of the theft and charged over $200,000 in fees; nearly $4 million was mixed through Wasabi Wallet.Some developers stated that they could not prevent North Korean hackers from laundering money through their platform, which has frustrated law enforcement agencies.

According to Onchain Lens monitoring, a certain whale exchanged 493.15 ETH for approximately 14.5 Bitcoin through THORChain, with the exchanged assets valued at approximately 1.1 million dollars and 1.09 million dollars respectively.The current ETH price is 2234 dollars, and the BTC price is 75737 dollars.

According to The Defiant, on-chain analytics company Elliptic stated that the Binance hacker has begun to exchange the stolen XRP, with approximately 50 million dollars' worth of XRP mostly converted to Bitcoin through THORChain. As of November 6, 16:45 Beijing time, about 226 million dollars' worth of XRP has not yet been transferred.Elliptic reported that the Bitcoin obtained from exchanging other stolen assets has reached about 1,650 coins, valued at approximately 124 million dollars, nearly doubling from the previous day, with the increase mainly coming from XRP exchanges. This portion is separate from the directly stolen 18,270 BTC, which, along with the main ETH holdings, has not yet been transferred.

After Binance suffered a major hacking attack, some strangers sent tiny amounts of Bitcoin to the hacker-controlled wallets via the blockchain, accompanied by messages that included begging, promotions, and money laundering suggestions. These transaction amounts are usually less than 1 dollar, and the senders utilized Bitcoin's OP_RETURN feature to write text information on the chain.One sender has repeatedly sent "Help me bro" to all 19 wallets held by the hacker since last Friday. The sender paid about 1000 satoshis (approximately 78 cents) for each wallet in each round, spending a total of about 46 dollars after three rounds, including fees, and has not received a response so far.Others suggested that the hacker go to THORChain via a link for asset swapping and stated not to return the funds to Binance founder CZ. A person claiming to be a Turkish crypto influencer promoted their own token and requested donations from the hacker to support their ecosystem. Another person left a message saying "Happy Hacklloween Satoshis for treats PLS." The hacker has not responded, and the stolen funds have not moved since last Thursday.

According to CoinDesk, the North Korean hacker group TraderTraitor is transferring the stolen funds from the $6.3 billion Binance hack through the decentralized cross-chain protocol THORChain, exchanging Ethereum for Bitcoin, which has driven the native token RUNE of THORChain to rise nearly 10% in the past 24 hours.The attackers first dispersed the stolen SOL across multiple wallets, exchanged it for USDC, and transferred it to the Ethereum network, then purchased ETH, and subsequently exchanged it for BTC through THORChain. Previously, the attackers had transferred some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1, the attackers have exchanged approximately $48.3 million through the protocol, ultimately receiving about $42.7 million, with fees and slippage losses of around 12%.The U.S. FBI has attributed the October 29 attack on Binance to TraderTraitor and has called on THORChain node operators and other crypto service providers to intercept related addresses and funds. Since BTC and ETH cannot be frozen by the issuer like USDT and USDC, cross-chain exchanges have increased the difficulty of recovering the stolen funds.Binance stated on Tuesday that it has frozen approximately $2.85 billion of the stolen funds and has covered about 98% of the affected tokens with company funds. On-chain analytics firm Elliptic believes that the stolen funds are currently still being transferred between different addresses and may not have been largely cashed out yet, with the attackers possibly planning to cash out in batches through over-the-counter trading channels.

According to monitoring by Lookonchain, the Binance hacker is continuously exchanging SOL for BTC. They first distribute SOL to multiple wallets and sell it for USDC; then, they transfer USDC to the Ethereum network via a cross-chain bridge and buy ETH, and finally, they exchange ETH for BTC through THORChain.

Arkham previously stated that the Binance hacker deposited approximately 4 million dollars into 3 Binance deposit addresses and speculated that these addresses might belong to third-party trading platforms that use Binance's liquidity and custody services.In response, SomaXBT stated that Arkham mistakenly identified the Thorchain Asgard Vault address as a Binance hacker address, and the related Binance deposits were actually paid by a Thorchain account, not by the Binance hacker depositing funds into Binance. SomaXBT also disclosed two related Thorchain account addresses.

According to HTX market information, the native token RUNE of the cross-chain protocol THORChain has dropped about 20% in the past 24 hours, briefly falling below $0.5. During the previous Bitget hacking incident, a large amount of funds were exchanged through THORChain, leading to a surge in trading volume and fees, which the market viewed as a positive for protocol revenue, resulting in an increase in RUNE.This decline is due to heightened regulatory and security risks, with the market concerned about whether THORChain can resolve the conflict between security and regulation while maintaining its permissionless nature. On-chain data shows that after the Binance hack, hackers deposited approximately 185.1 million TRX and 3.83 million USDT through THORChain, totaling about 2,697 deposits, net exchanging around $48.3 million, and actually receiving about $42.7 million, with losses of about $5.7 million due to fees and slippage.At the same time, the FBI, U.S. Secret Service, and IRS-CI jointly requested THORNode, RPC nodes, and DeFi service providers to intercept funds related to North Korean hackers. THORChain co-founder Chad Barraford stated that node operators do not have more information than the public and have not made a clear commitment to proactively block addresses. Another co-founder, JP Thor, publicly opposed cooperating with freezes, believing that the principles of decentralization and permissionlessness should be upheld.

On-chain analyst and Security Alliance contributor SomaXBT stated that North Korean hackers laundered approximately $242 million of stolen funds from Binance within two days. Meanwhile, the FBI is pressuring platforms like THORChain to halt related transactions.SomaXBT noted that the stolen funds were transferred through multiple cryptocurrency cross-chain bridges, with Relay handling $48 million in outflows, THORChain managing $44 million, Chainflip processing $32.1 million, and Symbiosis dealing with $16 million, totaling approximately $140 million. The final destination of these funds remains unclear.

THORChain stated that users have returned 10 ETH that was mistakenly paid due to Ethereum block reorganization, the relevant treasury has restored its solvency, and some chain transactions remain suspended.

Cointelegraph cited the blockchain analysis company Chainalysis, stating that an Ethereum reorganization unexpectedly hindered the transfer of stolen funds from Binance related to North Korean entities. A deposit of 10 ETH was refunded twice, prompting the cross-chain protocol THORChain to trigger an emergency pause.Reports indicate that this reorganization occurred on October 31, with THORChain processing two refunds for the same 10 ETH deposit, leading to the suspension of exchanges on 12 out of the 13 chains it supports. Chainalysis noted that this pause disrupted the cross-chain transfer paths associated with the stolen funds from Binance. Binance previously disclosed that an unauthorized transfer occurred from its hot wallet on October 29, affecting an estimated $6.3 billion, with institutions like Chainalysis linking the incident to the North Korean cybercrime organization TraderTraitor.

THORChain co-founder Chad Barraford stated that the information held by THORNode operators is publicly available and can be accessed in real-time, so law enforcement does not need to obtain relevant information through subpoenas. He believes this is the ideal situation for investigations.Previously, the FBI, United States Secret Service (USSS), and the Criminal Investigation Division of the Internal Revenue Service (IRS-CI) called on THORNode operators, RPC node operators, instant exchange platforms, and DeFi service providers to intercept transactions related to North Korean TraderTraitor attackers and the funds flowing from these addresses. This request involves the theft of over $6 billion in assets from Binance.

According to on-chain detective ZachXBT, approximately 45 minutes ago, about $6.3 billion in stolen funds from Binance and about $388 million in stolen funds from Bitget were transferred via THORChain and mixed at the same address, indicating that the two incidents may have been carried out by the same attacker.ZachXBT stated that the Bitget incident was previously linked to the North Korea-related TraiderTraitor, which also overlaps with cases such as Kelp DAO. The mixing address is 0x151....eb7.

According to on-chain analyst @ai_9684xtpa, a mysterious entity funded by Tornado has accumulated 3,000.5 ETH since October 23, worth 7.06 million dollars, and subsequently exchanged it for BTC through the cross-chain protocol THORChain.This entity had previously sold ETH in batches at price peaks and bought back at recent lows: sold at 3,109 dollars in January 2026, sold again at 2,679 dollars in September 2026, and bought back at 2,353 dollars in October 2026.

According to The Defiant, THORChain announced that its v3.21 upgrade will fix the FIN contract vulnerability on Rujira and allow the previously paused application layer to restart. The network has set the upgrade target at block height 28,366,100, with an expected time around October 23. After the restart, trading, lending, borrowing, and automated trading on Rujira will resume. Rujira's products run through smart contracts within THORChain, rather than on an independent blockchain, and the application layer can pause these contracts without affecting the underlying layer of THORChain.According to Rujira, the vulnerability was discovered on September 26, when an attacker transferred a custom concentrated liquidity position without holding a position. The team paused the application layer with the support of node operators, and only one position from the Rujira team itself was affected, with no loss of user funds. Rujira attributed the vulnerability to a flaw in the position transfer function, rather than the trading logic of the liquidity strategy. On September 27, Rujira stated that the fix is located at the underlying layer and has been scheduled for the v3.21 upgrade.Regarding the restart window, Rujira proposed a conditional grace period in its plan on October 15: if the application layer is ready to resume, any credit account position with a loan-to-value ratio above 100% and meeting liquidation conditions will request node operators to pause the credit account contract for an additional 24 hours, allowing borrowers to replenish collateral before liquidation resumes. Borrowers can replenish collateral through Rujira Borrow or by directly transferring assets to the credit account address. Rujira indicated on October 10 that positions still deemed unsafe after the grace period may be liquidated when the liquidator triggers the process.

According to on-chain investigator vxdb, the cryptocurrency exchange platform Gamdom is suspected to have been hacked, involving a total asset value of approximately 4.208 million USD.In terms of losses by chain, EVM networks such as Ethereum, BNB Chain, Polygon, Arbitrum, and Optimism account for about 2.2 million USD, Solana approximately 965,000 USD, TRON around 375,000 USD, and Bitcoin about 668,000 USD.On-chain tracking shows that some of the stolen funds have been transferred to platforms such as Hyperliquid and THORChain through cross-chain bridges and token exchanges.

The cross-chain exchange protocol THORChain officially announced that its native token RUNE has been 100% unlocked. The official statement indicated that the supply of RUNE has been continuously decreasing, starting with 1 billion tokens, which later dropped to 500 million. In May, based on ADR-023, 64.4 million RUNE were destroyed from reserves, further reducing the supply to 360 million.The official also introduced the system's revenue distribution. Nodes must bind RUNE to ensure the security of THORChain and receive 59% of the system's revenue, which comes from the fees paid by users during cross-chain exchanges. An additional 20% flows into the protocol's own liquidity, and every 3 days, the protocol deposits RUNE into the liquidity pool with the highest relative depth of fees, half of which is retained in the form of RUNE and held by THORChain.

According to The Defiant, the stablecoin issuer Tether has blacklisted four THORChain treasury addresses, which collectively hold approximately 1.45 million USDT.As a result, THORChain's Tron cross-chain exchanges and liquidity provider-related operations have been suspended. THORChain co-founder Chad Barraford stated that the team did not receive any prior notice before Tether took action.