THORChain Carried Stolen Binance and Bitget Funds as Scrutiny Grows

Funds stolen from Binance's $6.3 billion hack and September's Bitget exploit passed through THORChain (RUNE) before being combined at a single Ethereum address, onchain investigator ZachXBT reported on October 30, 2026. The finding puts the cross-chain decentralised exchange back in the middle of the largest crypto theft on record.

Where the Funds Went

ZachXBT said the stolen Binance and Bitget funds moved through THORChain and then landed at the same Ethereum address. The Bitget attack has been attributed to TraderTraitor, a North Korea-linked group. TRM Labs and Chainalysis also linked the Binance hack to the same group, according to Cointelegraph.

The market moved on the news. RUNE rose more than 13% on Friday after Binance confirmed the hack, climbing to $0.67 from a local low of $0.59 at 12:20 a.m. UTC, according to TradingView data. The token later changed hands near $0.62 on November 1, 2026, based on Coinranking data.

Why THORChain Cannot Block Swaps

THORChain lets users swap assets across blockchains without a central operator. After the Bitget exploit, Bitget CEO Gracy Chen publicly called on THORChain to block the attacker's addresses, arguing that decentralisation should not shield known stolen funds. THORChain rejected the request, saying it has no mechanism to block individual swaps. It noted that node operators can pause trading for an entire blockchain or across the whole network to address security risks.

That design is deliberate. The protocol treats swaps as unstoppable by default, which is why it is popular with traders and, repeatedly, with hackers. THORChain is one of the largest DEX tokens by market capitalisation and sits among DeFi coins on Coinranking.

A Recurring Role

This is not the first time THORChain has carried stolen funds. North Korean hackers used the protocol to move money from the $1.4 billion Bybit hack in February 2025, and funds from Bitget's exploit also crossed THORChain. The Bybit episode divided THORChain's own contributors: core developer Pluto left after a halt on Ether trading was reversed, and validator TCB threatened to exit unless the protocol stopped processing North Korea-linked funds.

Since the Bybit hack, THORChain has generated about $5 million in fees on $5.4 billion of volume, Cointelegraph has reported.

What to Watch

The Binance recovery is still in progress, with the exchange saying it has covered 90% of the impacted amount and targeting Sunday for withdrawals. Whether THORChain's node operators choose to pause any chain this time remains an open question, and so does the broader debate about where unstoppable design ends and stolen funds begin.