RUNE Climbs 9% as TraderTraitor Resumes Binance Loot Laundering via THORChain

Binance Loot Moves Through THORChain Again

North Korea's TraderTraitor group has resumed laundering proceeds of Binance's $6.3 billion heist through THORChain, and the network's token moved with the traffic: the RUNE price rose as much as 10.6% to $0.637 earlier on Wednesday and now trades near $0.631, up about 9% over 24 hours but roughly 0.5% below its 12:49 UTC reading, after the protocol restored RUNE swaps on most chains following the Oct. 31 halt. The protocol works as one of crypto's best-known cross-chain bridges, settling trades between blockchains without an account at a centralized venue, so renewed swap traffic feeds straight into its token: THORChain (RUNE) is paired with assets in the liquidity pools, collects fees on every trade and settles both sides of each exchange. On-chain data shows the attackers splitting stolen SOL across multiple wallets, selling it into USDC, the dollar-pegged stablecoin, and forwarding the proceeds to Ethereum, where they bought ether and converted it to bitcoin. That conversion relies on atomic swaps, which exchange one chain's asset for another's without a custodian ever holding the funds. Unlike a centralized exchange, the protocol performs no identity checks and holds no user balances, which is why stolen money can move without meeting a compliance gate. In a Nov. 1 analysis, on-chain investigator SomaXBT estimated the attackers had pushed roughly $48.3 million through THORChain while receiving $42.7 million back, an implied loss near 12% to fees, slippage and execution prices. That wave followed an earlier conversion push from Tron. Laundering traffic is fee traffic, and the pattern has a precedent: after the 2025 Bybit hack, THORChain (RUNE) handled a record $4.66 billion of swaps in the seven days to March 2, one of the richest fee stretches the pools have recorded.

Nov. 1 analysishttp://x.com/somaxbt/status/2116884715399454727

The strongest support below the market sits at $0.6169, scored 100/100 on COINOTAG's composite, where the 20-day and 50-day EMAs and the recent swing low converge, while the nearest resistance of consequence waits at $0.6759, scored 91/100. Momentum reads neutral: the RSI printed 49.40, and the higher-timeframe trend is still down. Positioning stays thin, with open interest near $7.23 million and a perp funding rate of 0.0030%, so the rally has not been carried by leveraged longs. A sustained break above $0.6759 would challenge the downtrend; rejection there sends the token back toward the $0.6169 floor. The full level set is laid out on our RUNE technical analysis page.

FBI Alert and the Freeze Gap

The Oct. 31 FBI alert named TraderTraitor as the perpetrator of the Oct. 29 theft and called on its node operators across THORChain (RUNE), on decentralized finance services and on crypto businesses generally to refuse transactions tied to the group's addresses, or to funds derived from them. The demand runs into the conversion strategy's logic: issuers of tokens such as USDT and USDC can freeze balances at the source, and more than $3 billion stolen from Binance has been frozen that way, but bitcoin and ether carry no issuer with a freeze switch. Binance said on Tuesday that roughly $2.85 billion of the stolen assets were frozen and that company funds had covered about 98% of the affected tokens. The operation also shows signs of automation. Elliptic's analysts recorded swap amounts of matching size entering THORChain, while a Tron-based distribution wallet disbursed funds hourly for more than a day, with receiving wallets typically passing money on within about two minutes. SomaXBT's Nov. 1 snapshot counted 2,697 separate deposits into THORChain, and the interfaces used to submit the swaps, typically dapps built on the protocol, earned an estimated $95,000 in affiliate fees. The trail itself stays visible, because every swap is publicly recorded on-chain, allowing transfers to be connected across networks. Trading was interrupted on Oct. 31, when an Ethereum block reorganization exposed a refund fault: the network paid out 10 ETH a vault had never collected, and the halt, which also delayed laundering of the stolen funds, stopped swaps on 10 chains before service returned. The operators have resisted freeze requests before: in September, THORChain rejected a Bitget request to blacklist addresses tied to a $388 million breach of that exchange, arguing its emergency controls pause wider network activity rather than individual swaps. That theft was also attributed to North Korea, and its funds later commingled on-chain with the Binance proceeds, just as these rails carried money stolen from Bybit in 2025. Elliptic's assessment holds that a negligible share of the Binance loot has been cashed out, with most assets parked in addresses linked to the theft. That picture holds only while the money stays on-chain: Elliptic expects further ether-to-bitcoin conversion in smaller batches, with cash-out attempts through over-the-counter brokers stretching across months, the stage where investigators get their next realistic chance to intercept.