North Korea’s TraderTraitor group is using THORChain to move cryptocurrency stolen in the $6.3 billion Binance hack, exchanging ether for bitcoin as investigators track another wave of cross-chain transfers.

The attackers have increased their use of THORChain, a decentralized exchange protocol that enables cryptocurrency swaps between different blockchain networks without centralized intermediaries.

THORChain’s RUNE token surged nearly 10% over the past 24 hours as cross-chain trading resumed. Higher swap volumes generate transaction fees for the protocol, while RUNE is used within its liquidity pools and settlement system. The network previously handled $4.66 billion in swaps during the week ending March 2, 2025, following the Bybit security breach.

According to Lookonchain, the hackers have been splitting stolen Solana (SOL) across several wallets before selling the tokens for USDC. They then transfer the stablecoins to Ethereum, purchase ether and exchange it for bitcoin through THORChain.

This follows an earlier laundering operation involving funds transferred from Tron. Blockchain investigator SomaXBT estimated on November 1 that the attackers had routed approximately $48.3 million through THORChain but received only $42.7 million. Fees and unfavorable execution prices accounted for an estimated 12% reduction in the transferred value.

The FBI officially attributed the October 29 Binance breach to North Korea’s TraderTraitor group in an October 31 warning. The agency called on THORChain node operators, decentralized finance platforms and other cryptocurrency companies to block transactions involving the identified hacker addresses and related stolen assets.

The shift toward bitcoin and ether creates additional challenges for recovery efforts. Stablecoin companies can freeze assets such as USDT and USDC, and more than $3 billion associated with the Binance incident has reportedly been frozen. However, neither Bitcoin nor Ethereum has a central issuer capable of freezing funds held in individual wallets.

THORChain allows cryptocurrency holders to exchange assets across blockchains without depending on centralized exchanges. Elliptic’s investigation identified repeated transaction patterns suggesting that the hackers were automating their transfers. A distribution wallet on Tron reportedly sent funds every hour for more than a day, while recipient wallets generally forwarded the assets within approximately two minutes.

SomaXBT identified 2,697 deposits into THORChain in its November 1 analysis. The investigator also estimated that platforms facilitating the swaps had collected around $95,000 through affiliate fees.

The laundering operation encountered a temporary setback on October 31 when an Ethereum block reorganization exposed a vulnerability in THORChain’s refund mechanism. The protocol mistakenly released 10 ETH that had not reached its vault, forcing a suspension of trading. Chainalysis said the disruption also slowed the hackers’ transfer operations.

THORChain has previously declined requests to selectively freeze suspicious transactions. In September, the protocol rejected a request from Bitget to block wallet addresses connected to the attacker responsible for the exchange’s $388 million breach. THORChain explained that its emergency mechanisms were designed to suspend wider network activity rather than selectively prevent individual swaps.

The Bitget incident was also attributed to North Korean hackers. Chainalysis subsequently found that funds from that attack had mixed onchain with proceeds from the Binance exploit. The protocol had also been used to move cryptocurrency stolen in the 2025 Bybit hack.

Despite the use of multiple blockchain networks, investigators can continue tracking the stolen assets because transaction records remain publicly accessible. Elliptic estimated that only a very small portion of the Binance proceeds had likely been converted into cash. Most of the activity involved moving cryptocurrency between wallets while maintaining links to addresses associated with the original theft.

Binance reported Tuesday that approximately $2.85 billion connected to the breach had been frozen. The exchange also said it had replaced around 98% of the affected tokens using its corporate funds.

Elliptic expects the attackers to continue converting ether into bitcoin through smaller transactions before attempting to withdraw the funds through over-the-counter (OTC) brokers over the coming months. These intermediaries facilitate cryptocurrency trades outside public exchanges, potentially creating additional opportunities for investigators to identify and disrupt the movement of the stolen assets.