North Korean hackers laundered $42.7M in stolen Binance funds through THORChain; RUNE dropped 20% as US agencies push for address freezes but co-founders resist.
Security & Exploits ·
North Korean hackers tied to the Lazarus Group used THORChain's cross-chain swaps to launder stolen Binance assets following a major breach. On-chain data indicated the attackers moved approximately $42.7 million through the protocol, prompting US law enforcement to request node operators block related transactions. RUNE, THORChain's native token, fell roughly 20% and briefly traded below $0.50 in response to the security incident and ensuing regulatory pressure.
The tension stems from THORChain's design philosophy versus compliance demands. The FBI released a list of compromised addresses and specifically called on THORChain node operators, along with other digital asset service providers, to freeze or halt flows connected to the theft. However, THORChain co-founder JP Thor publicly opposed such measures, arguing that node operators should maintain the protocol's permissionless ideals rather than cooperate with enforcement requests, framing intervention as a failure of decentralization.
Whether THORChain's approximately 100 nodes will comply remains uncertain. Developer Chad Barraford noted that only around 50 individuals operate those nodes, and if they refuse to halt the protocol or block addresses, node operators could face legal risk given federal and Secret Service involvement. THORChain's governance allows a two-thirds majority vote to halt activity, and nodes can also exit the network unilaterally, but the outcome of coordination efforts or enforcement actions has not been determined.