RUNE Rallies 13% as THORChain Reappears in Binance Hack Trail

THORChain's RUNE token rose more than 13% on Friday after Binance confirmed a record $6.3 billion hack — a rally that coincided with fresh on-chain evidence tying the protocol to the movement of the stolen funds. The token climbed to $0.67 from a local low of $0.59 recorded at 12:20 a.m. UTC, according to TradingView data.

The gain is an uncomfortable one for the protocol. On-chain investigator ZachXBT reported on Friday that funds stolen from Binance, and from September's Bitget hack, had passed through THORChain before being combined at the same Ethereum address. The claim is on-chain and traceable; whether the market's rally reflects anything beyond speculation is a separate question the price action does not answer.

Who is behind the attacks?

ZachXBT attributed the Bitget attack to TraderTraitor, a group linked to North Korea. Blockchain analytics firms TRM Labs and Chainalysis have also linked the Binance hack to the same group. The convergence of attribution across three independent investigators strengthens the finding, though none of the firms has published the full evidentiary trail.

Is this a pattern for THORChain?

It is the third documented case. THORChain, which lets users swap assets across blockchains, was previously used to launder funds stolen in the $1.4 billion Bybit hack in February 2025. The protocol was also used to move proceeds from the $388 million Bitget hack — roughly one-quarter of the Bybit loss, and, for scale, a sum larger than the annual budget of many mid-sized financial regulators.

Following the Bitget exploit, Bitget CEO Gracy Chen publicly called on THORChain to block the attacker's addresses. "Decentralization is a design principle, not a shield for facilitating known stolen funds," she said. The quote cuts to the protocol's core governance dilemma, but it did not change the outcome.

THORChain rejected the request. The protocol said it has no mechanism to block individual swaps, and that node operators can only pause trading for an entire blockchain or across the whole network to address security risks. In plain terms, the protocol cannot discriminate between a criminal transaction and an ordinary one — it can only switch everything off.

What has the pressure cost the project?

The stance has produced internal fractures. After the Bybit hack, core developer Pluto announced his departure when a halt on Ether trading was reversed. Validator TCB threatened to leave unless the protocol stopped processing North Korea-linked funds. THORChain has also generated $5 million in fees and $5.4 billion in volume since the Bybit hack — revenue that arrives, in part, from swaps it cannot and will not filter.

That revenue figure is the protocol's implicit defense and its critics' strongest exhibit at once. The protocol processes volume regardless of origin; the fee income follows.

The governance question remains unresolved. No working mechanism exists to block individual swaps, and no contributor has proposed one that preserves the protocol's design. As North Korea-linked groups continue to route stolen funds through THORChain, expect regulatory attention to shift from the hackers themselves to the infrastructure that carries their proceeds.