North Korean hackers restart the money laundering of funds stolen from Binance, pushing RUNE's 24-hour increase to nearly 10%

According to CoinDesk, the North Korean hacker group TraderTraitor is transferring the stolen funds from the $6.3 billion Binance hack through the decentralized cross-chain protocol THORChain, exchanging Ethereum for Bitcoin, which has driven the native token RUNE of THORChain to rise nearly 10% in the past 24 hours.

The attackers first dispersed the stolen SOL across multiple wallets, exchanged it for USDC, and transferred it to the Ethereum network, then purchased ETH, and subsequently exchanged it for BTC through THORChain. Previously, the attackers had transferred some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1, the attackers have exchanged approximately $48.3 million through the protocol, ultimately receiving about $42.7 million, with fees and slippage losses of around 12%.

The U.S. FBI has attributed the October 29 attack on Binance to TraderTraitor and has called on THORChain node operators and other crypto service providers to intercept related addresses and funds. Since BTC and ETH cannot be frozen by the issuer like USDT and USDC, cross-chain exchanges have increased the difficulty of recovering the stolen funds.

Binance stated on Tuesday that it has frozen approximately $2.85 billion of the stolen funds and has covered about 98% of the affected tokens with company funds. On-chain analytics firm Elliptic believes that the stolen funds are currently still being transferred between different addresses and may not have been largely cashed out yet, with the attackers possibly planning to cash out in batches through over-the-counter trading channels.