The native token of cross-chain liquidity protocol THORChain, RUNE, experienced a notable upward trajectory on Friday, climbing more than 13% following the confirmation of a staggering $6.3 billion hack targeting major cryptocurrency exchange Binance.
According to market data from TradingView, RUNE rallied to $0.67 at the time of writing, recovering sharply from a local low of $0.59 recorded earlier in the session at 12:20 a.m. UTC. The sudden price movement coincided with intense industry-wide scrutiny surrounding the protocol’s infrastructure, cross-chain bridging capabilities, and its ongoing vulnerability to exploitation by sophisticated state-sponsored threat actors.
The renewed market attention and controversy were ignited early Friday when prominent onchain investigator ZachXBT reported that funds stolen from the massive Binance breach—alongside capital siphoned during September’s high-profile Bitget hack—had been routed through THORChain before being consolidated into a single Ethereum address.
ZachXBT publicly attributed the Bitget attack to the notorious North Korea-linked cybercrime collective known as TraderTraitor. Furthermore, blockchain intelligence heavyweights TRM Labs and Chainalysis also released findings directly linking the catastrophic Binance hack to the same state-sponsored grouping, drawing immediate parallels to a string of historic crypto heists orchestrated by Pyongyang-backed hackers over the past few years.
THORChain operates as a decentralized liquidity protocol designed to facilitate native asset swaps across disparate blockchains without the need for traditional wrapped tokens or centralized intermediaries. However, this foundational cross-chain utility has increasingly made the protocol an attractive venue for malicious actors seeking to obscure the trail of stolen digital assets. North Korean hackers have previously leveraged the infrastructure to move and launder funds acquired through high-profile exploits, most notably during the colossal $1.4 billion Bybit hack that shook the cryptocurrency ecosystem in February 2025. Additionally, the protocol was utilized to shift funds stolen in the $388 million Bitget security breach.
The recurring utilization of THORChain as a laundering conduit for stolen funds has previously triggered fierce internal and external debates regarding governance, decentralization, and platform accountability. Following the Bitget exploit, Gracy Chen, the CEO of Bitget, publicly appealed to THORChain to intervene and block the attacker’s associated wallet addresses. In a sharply worded public statement posted to social media, Chen argued that decentralization should serve as a fundamental design principle rather than a protective shield for facilitating the movement of known stolen funds.
Despite mounting external pressure from exchange executives and security analysts, THORChain staunchly rejected the request. Protocol representatives maintained that the network possesses no built-in mechanism designed to selectively block individual swaps or freeze specific addresses due to its immutable architecture. Instead, the network’s design dictates that individual node operators can only respond to systemic security threats by temporarily halting trading activities for an entire connected blockchain or shutting down cross-chain operations across the entire network.
The ideological rift over how to handle state-sponsored exploits has previously exposed deep fractures within the THORChain contributor community. The earlier Bybit hack similarly triggered intense internal division among developers and validators. Pluto, a core developer for the protocol, announced his official departure from the project after a controversial decision to halt Ether trading on the network was subsequently reversed. Around the same time, network validator TCB issued public ultimatums, threatening to abandon the platform unless decisive action was taken to prevent the protocol from processing transactions linked to North Korean cyber operations.
As investigations into the historic Binance and Bitget breaches continue to unfold, the latest developments underscore the persistent challenges decentralized finance protocols face in balancing core tenets of censorship resistance and architectural autonomy against the escalating threat of sophisticated, state-sponsored cybercrime syndicates.
Comments (0)