North Korean hackers laundered $242M in stolen Binance funds through THORChain and other DeFi protocols, generating massive revenue spikes of up to 2,229% for the platforms.
Security & Exploits ·
On-chain investigations traced hundreds of millions of dollars in cryptocurrency stolen from Binance on October 30 through multiple decentralized finance protocols, with THORChain, Relay, and SunSwap emerging as the primary conduits. The laundering activity generated over $100,000 in daily protocol revenue across five platforms, including Symbiosis and Chainflip. THORChain and Relay experienced the most dramatic spikes, with daily revenues rising 2,229% and 1,954% respectively compared to typical October levels, while SunSwap recorded an 815% increase.
Analysis attributed $242 million of the stolen funds to movement through the Tron network within two days, with THORChain processing over $48 million as the largest exit route. The hackers ultimately recovered $42.7 million after losses to fees and slippage, while protocol interfaces collected approximately $95,000 in affiliate fees from those transactions. Relay, Chainflip, and Symbiosis handled approximately $48 million, $32.1 million, and $16.0 million respectively, according to on-chain tracing.
The FBI formally attributed the breach to North Korea's TraderTraitor, though the full scope of recovered stolen funds remains unclear. Tether froze over $378 million in USDT from the original $628 million stolen on the Tron network, leaving more than $3 billion in untouched stolen assets distributed across other blockchains.