Thorchain Daily Revenue Jumps 2229% on Binance Hack Fund Laundering

Five Protocols, $101,144 in Laundering Fees

Fee gains tied to the Binance hack were real but tightly bounded: five major DeFi protocols earned an estimated $101,144 in total from moving the stolen assets, and daily revenue at some of them ran more than 20 times above their normal level. The estimate comes from on-chain investigator Detective, who traced transactions on Tron from October 29 through November 1 using addresses that blockchain analytics firm Elliptic and the FBI had published. Transactions whose connection to the Binance hackers could not be established were dropped from the tally, and that exclusion cuts both ways: a swap-routing smart contract called BWSwapRouterV1 processed roughly $58 million across 3,561 transactions and may have collected about $175,000 in fees, but because its link to hack funds was never confirmed, it stays outside the official figure. Within the confirmed set, Sunswap took the largest share at $29,697, followed by Thorchain at $28,184 and Relay at just over $23,000, while Symbiosis cleared $10,000 and Chainflip recorded $7,433. Measured against each protocol's October daily average, the swings are steeper: Thorchain's daily revenue surged 2,229%, Relay's climbed 1,954%, Sunswap's rose 815%, Symbiosis gained 358% and Chainflip added 194%. The mechanism is simple. The hackers swapped the stolen assets into other digital assets and pushed them across multiple blockchains, and every hop through a decentralized exchange or a bridge protocol collects a fee, so the infrastructure pays out on illicit flows exactly as it does on legitimate trading.

Protocol	Estimated fees	Change vs October average
Sunswap	$29,697	+815%
Thorchain	$28,184	+2229%
Relay	$23,000+	+1954%
Symbiosis	$10,000+	+358%
Chainflip	$7,433	+194%

$242 Million Moved on Tron

Separate on-chain analysis puts the scale of the movement far higher. Analyst SomaXBT tracked about $242 million moved on Tron, the layer-1 network, over two days, with roughly $194 million of that exiting to other chains through cross-chain services. The per-protocol split of the outflows: about $48 million passed through Relay and about $44 million through Thorchain, while Chainflip processed $32.1 million and Symbiosis $16 million. The two tallies measure different sides of the same laundering push, one the gross volume and the other the fees that volume generated. Cross-chain services sit at the center of the path because they convert assets between chains without a centralized intermediary, though they still charge for each conversion. The FBI, in its October 31 announcement, attributed the underlying theft of more than $6 billion in digital assets from Binance to TraderTraitor, a hacking group it links to North Korea. According to the bureau, the stolen assets are being converted mainly into Ethereum and pushed through DeFi services and instant-exchange platforms for further laundering. It has asked Thorchain node operators, which run bonded validator infrastructure comparable to a masternode, along with DeFi service providers, to block transactions from the wallets tied to the case. Compliance has been leaky. Chainflip disclosed that some blocked funds were refunded to newly created addresses and then flowed back in, with a portion of the retried transactions passing security screening. The company says it has since upgraded its systems so that refund addresses are linked back to the original source of the funds during detection.

The dollar amounts are small by industry standards: Thorchain's roughly $28,000 windfall is a rounding error next to weekly fee leaders such as Papertrade's 7-day protocol revenue, which recently slipped to $8.5 million. The anomaly is the percentage swing, and it is a direct function of laundered volume rather than any change in the products themselves. The same fee-revenue lens applies across networks, which is why COINOTAG's Sui coverage tracks protocol income and supply events such as the 13.15 million SUI unlock on November 1. What the sources still describe as exposed is the enforcement layer: interdicted funds can return through fresh refund addresses, as Chainflip's own disclosure showed, and the FBI continues to describe laundering attempts through DeFi and instant-exchange services as ongoing.