North Korean hackers previously used THORChain to move funds stolen from Bybit and Bitget, prompting calls for the protocol to intervene.
THORChain’s RUNE token rose more than 13% on Friday after Binance confirmed a $6.3 billion hack.
RUNE climbed to $0.67 at the time of writing from a local low of $0.59 at 12:20 a.m. UTC, according to TradingView data.
Onchain investigator ZachXBT reported Friday that funds stolen from Binance and September’s Bitget hack had passed through THORChain before being combined at the same Ethereum address.
ZachXBT said the Bitget attack had been attributed to North Korea-linked TraderTraitor. TRM Labs and Chainalysis have also linked the Binance hack to the group.
THORChain allows users to swap assets across blockchains. North Korean hackers previously used the protocol to launder funds stolen in the $1.4 billion Bybit hack in February 2025. The protocol was also used to move funds stolen in the $388 million Bitget hack.
Following Bitget’s exploit, CEO Gracy Chen called on THORChain to block the attacker’s addresses, saying, “Decentralization is a design principle, not a shield for facilitating known stolen funds.”
THORChain rejected the request, saying it has no mechanism to block individual swaps. It said node operators can pause trading for an entire blockchain or across its network to address security risks.
The Bybit hack also divided contributors as core developer Pluto announced his departure after a halt on Ether trading was reversed. Validator TCB threatened to leave unless the protocol stopped processing North Korea-linked funds.
Related: THORChain generates $5M in fees, $5.4B in volume since Bybit hack