BlockBeats, citing on-chain monitoring, reported that North Korean group TraderTraitor was moving proceeds from the $6.3 billion Binance hack through THORChain, swapping Ethereum for Bitcoin. THORChain’s RUNE rose nearly 10% over 24 hours.
Cross-chain route
The attackers dispersed stolen SOL, swapped it for USDC, moved funds to Ethereum, bought ETH and then used THORChain to swap into BTC. SomaXBT estimated that about $48.3 million had been swapped through the protocol by Nov. 1, with roughly $42.7 million received after fees and slippage.
Source: BlockBeats English report, published Nov. 4, 2026.