THORChain’s native token, RUNE, surged more than 13% on Friday following Binance’s confirmation of a $6.3 billion security breach. According to TradingView data, the asset climbed from a local low of $0.59 at 12:20 a.m. UTC to $0.67. This price movement coincided with reports by onchain investigator ZachXBT that funds stolen in the Binance incident and September’s Bitget hack had passed through THORChain before being consolidated at a single Ethereum address.
ZachXBT attributed the Bitget attack to North Korea-linked TraderTraitor, while TRM Labs and Chainalysis have also linked the recent Binance hack to this group. THORChain, which facilitates cross-chain asset swaps, has previously been utilized by North Korean hackers to launder funds from the $1.4 billion Bybit exploit in February 2025 and the $388 million Bitget theft. Following the Bitget incident, CEO Gracy Chen urged THORChain to block attacker addresses, arguing that decentralization should not shield stolen funds. However, THORChain rejected the request, stating it lacks mechanisms to block individual swaps, though node operators can pause trading for entire blockchains or across the network to mitigate security risks.
The protocol's handling of these incidents has caused internal friction. Core developer Pluto departed after a reversal of an Ether trading halt, and validator TCB threatened to leave unless the protocol stopped processing North Korea-linked funds. Despite these controversies, related reporting indicates THORChain generated $5 million in fees and $5.4 billion in volume since the Bybit hack.
The correlation between a major exchange breach and a decentralized protocol's token appreciation highlights a complex market dynamic where liquidity flows and fee generation are valued alongside reputational risk. While the $6.3 billion Binance hack represents a severe security failure for the centralized entity, THORChain’s immediate price surge suggests traders may be interpreting the increased cross-chain activity as a net positive for protocol usage, despite the illicit nature of some inflows. This disconnect underscores how speculative markets often prioritize volume metrics over compliance narratives in the short term.
However, the operational and governance tensions within THORChain present significant long-term risks. The protocol’s inability to block specific swaps, contrasted with its capacity to halt entire chains, creates a binary response mechanism that may prove inadequate against sophisticated laundering techniques employed by state-linked actors like TraderTraitor. The departure of key contributors such as Pluto and threats from validators indicate growing internal dissent regarding ethical stewardship. If institutional adoption continues to face scrutiny over AML/CFT compliance, THORChain’s reliance on high-volume, potentially tainted liquidity could invite regulatory pressure that outweighs current fee revenue.
