RUNE, the native token of cross-chain protocol THORChain, rallied more than 13% on Friday following confirmation of a $6.3 billion breach at Binance. The token climbed to $0.67 from a low of $0.59, according to TradingView data. But the price movement masks a more troubling narrative: investigators say stolen funds from the Binance attack have already flowed through THORChain’s liquidity pools, raising fresh questions about the protocol’s role in facilitating financial crime.
According to reporting by CoinTelegraph, onchain detective ZachXBT confirmed Friday that cryptocurrency stolen from both Binance and September’s $388 million Bitget hack passed through THORChain before converging at the same Ethereum address. Chainalysis and TRM Labs have attributed both attacks to North Korea-linked threat actor TraderTraitor, marking another instance where the protocol has been weaponised for cross-border fund movement by state-sponsored criminals.
THORChain’s Dilemma: Decentralisation vs. Compliance
The revelation has reignited a simmering conflict between THORChain’s design philosophy and pressure from the broader crypto industry to act against known malicious actors.
THORChain operates as a decentralised liquidity network, allowing users to swap assets across different blockchains without intermediaries. That architecture is precisely what makes it attractive to criminals: no central authority can freeze accounts or reverse transactions. When Bitget CEO Gracy Chen requested in September that THORChain block addresses linked to the exchange’s stolen funds, the protocol refused, arguing that it lacks a mechanism to target individual swaps. Node operators can only pause trading for entire blockchains or across the entire network—a blunt instrument that would disrupt legitimate users.
“Decentralisation is a design principle, not a shield for facilitating known stolen funds,” Chen said at the time. THORChain’s response highlighted the fundamental tension: true decentralisation means relinquishing the ability to discriminate between transactions, even illegal ones.
Internal Fractures Widen Over Enforcement
The Binance hack discovery comes as THORChain remains fractured over its handling of North Korean-linked fund flows. The February 2025 Bybit breach—which saw $1.4 billion stolen—was also processed through THORChain, triggering an internal crisis.
Core developer Pluto departed the project after the protocol reversed a halt on Ether trading mid-incident, signalling frustration with inconsistent security responses. More dramatically, validator TCB threatened to exit entirely unless THORChain stopped processing funds traced to North Korean actors. The dispute exposed a governance weakness: without a clear policy or enforcement mechanism, individual contributors resort to threats rather than coordinated action.
The Bybit and Bitget incidents have been wildly profitable for THORChain’s operators. The protocol generated $5 million in fees and $5.4 billion in trading volume since the Bybit hack alone. That financial incentive—however unintended—creates a perverse dynamic where security incidents drive protocol revenue.
Market Reaction vs. Reputational Risk
Friday’s 13% RUNE rally suggests traders are pricing in positive sentiment, perhaps viewing the Binance hack’s scale as validation of THORChain’s utility for large-value transactions. Yet the correlation between stolen fund flows and token appreciation should concern investors. If THORChain becomes widely perceived as the path of choice for laundering major theft proceeds, regulatory scrutiny will intensify.
Neither Binance nor the U.S. authorities have publicly commented on THORChain’s role in the stolen funds’ movement. But the pattern is now undeniable: North Korean hackers have repeatedly chosen THORChain as their preferred bridge. Without a credible mechanism to exclude bad actors—or at minimum, a governance consensus that attempts to do so—the protocol risks becoming synonymous with sanctions evasion and financial crime.