The native token of the THORChain protocol experienced a sharp price increase on Friday, climbing more than 13% to reach approximately $0.67. This surge followed the confirmation by Binance of a massive security breach estimated at $6.3 billion, the largest cryptocurrency theft reported to date. According to TradingView data cited by Cointelegraph, the asset rose from a local low of $0.59 recorded in the early hours of the day. The market reaction coincided with new on-chain intelligence suggesting that proceeds from the Binance exploit have already been routed through decentralized cross-chain infrastructure.

Stolen funds traced through cross-chain swaps

On-chain investigator ZachXBT reported that cryptocurrency stolen from Binance and from a separate September attack on Bitget had passed through THORChain before being consolidated at a single Ethereum address. The Bitget incident, valued at $388 million, was attributed to a group known as TraderTraitor, which is linked to North Korea. Blockchain analytics firms TRM Labs and Chainalysis independently corroborated these findings, linking the recent Binance breach to the same North Korean-linked actors. Binance stated that its preliminary investigation indicated a compromised DevOps engineer’s laptop may have allowed attackers to access internal systems and execute unauthorized withdrawal transactions.

Protocol faces recurring criticism over stolen assets

This development places THORChain back in the spotlight after it was previously used to launder funds from the $1.4 billion Bybit hack in February 2025. Following the earlier Bitget exploit, CEO Gracy Chen publicly urged the protocol to block the attacker’s addresses, arguing that decentralization should not serve as a shield for facilitating known stolen funds. THORChain rejected this request, explaining that its architecture does not include a mechanism to block individual swaps. The protocol noted that while node operators can pause trading for an entire blockchain or across the network to address security risks, they cannot target specific transactions or addresses.

Internal divisions and future outlook

The controversy surrounding the use of the protocol for illicit transfers has previously caused significant friction within the THORChain community. Core developer Pluto announced his departure after a halt on Ether trading was reversed, while validator TCB threatened to leave unless the protocol ceased processing funds linked to North Korean hackers. As investigators continue to track the movement of the $6.3 billion in stolen assets, attention remains focused on how decentralized protocols can respond to such incidents. The current situation highlights the ongoing tension between maintaining permissionless infrastructure and preventing the infrastructure from being used to move assets connected to major cryptocurrency thefts.