RUNE gains nearly 10% in 24 hours, as North Korean hackers resume money laundering of funds stolen from Binance.

North Korean hacking group TraderTraitor is using decentralized cross-chain protocol THORChain to launder proceeds from the $6.3 billion Binance hack, converting Ethereum (ETH) to Bitcoin (BTC) and pushing THORChain’s native token RUNE up nearly 10% in the past 24 hours. Attackers first split the stolen Solana (SOL) across multiple wallets, converted it to USDC, and bridged it to the Ethereum network, then purchased ETH before swapping it to BTC via THORChain. Earlier, the attackers had already transferred some funds from the Tron network to THORChain. On-chain investigator SomaXBT estimates that as of November 1, the attackers had swapped roughly $48.3 million via the protocol, receiving around $42.7 million net, with fees and slippage accounting for approximately 12% of the total amount. The U.S. FBI has attributed the October 29 Binance hack to TraderTraitor, and is calling on THORChain node operators and other crypto service providers to block related addresses and funds. Since BTC and ETH cannot be frozen by their issuers like USDT and USDC, cross-chain swaps have complicated efforts to recover the stolen funds. Binance said Tuesday it has frozen approximately $2.85 billion in stolen funds and covered around 98% of affected tokens using its own reserves. On-chain analytics firm Elliptic notes that the stolen funds are currently mostly being moved between various addresses, likely not yet cashed out on a large scale, and the attackers may later liquidate the funds in batches via over-the-counter (OTC) trading channels.