RUNE surges nearly 10% in 24 hours, North Korean hackers resume money laundering of stolen Binance funds.

November 4th - North Korean hacking group TraderTraitor is transferring the proceeds from the $6.3 billion Binance hack through the decentralized cross-chain protocol THORChain, swapping Ethereum for Bitcoin, which has driven THORChain's native token RUNE up nearly 10% in the past 24 hours.

The attackers first dispersed the stolen SOL to multiple wallets, swapped it for USDC and transferred it to the Ethereum network, then bought ETH, and subsequently cross-chain swapped it for BTC through THORChain. Previously, the attackers had already moved some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1st, the attackers had swapped approximately $48.3 million through the protocol, ultimately receiving about $42.7 million, with fees and slippage losses of approximately 12%.

The FBI has attributed the October 29th Binance attack to TraderTraitor and has called on THORChain node operators and other crypto service providers to block the relevant addresses and funds. Since BTC and ETH cannot be frozen by issuers like USDT and USDC, cross-chain swaps increase the difficulty of recovering the stolen funds.

Binance stated on Tuesday that it has frozen approximately $2.85 billion in stolen funds and has covered about 98% of the affected tokens through company funds. On-chain analysis firm Elliptic believes that the stolen funds are currently still mainly being moved between different addresses and may not yet have been cashed out on a large scale, and the attackers may subsequently cash out in batches through OTC channels.