Hackers from the group the FBI calls TraderTraitor, which U.S. authorities link to North Korea, resumed moving part of the funds stolen from Binance through the decentralized exchange THORChain on Nov. 4, swapping ether for bitcoin, on-chain data showed.
RUNE, THORChain's token, jumped 10.6% to $0.637 as the transfers picked up, according to CoinGecko.
The Oct. 29 theft from Binance totaled $6.3 billion, the biggest cryptocurrency heist ever recorded. On-chain analyst SomaXBT found the hackers laundered $242 million through the Tron network in the first two days alone.
Another $140 million moved through swap services: Relay ($48 million), THORChain ($44 million), Chainflip ($32.1 million) and Symbiosis ($16 million). A separate SomaXBT analysis found that by Nov. 1, $48.3 million had passed through THORChain alone, of which $42.7 million reached its destination after fees and slippage.
On Nov. 1, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, published a roster of 608 Ether wallets, 19 Bitcoin wallets and one Solana wallet tied to the theft.
Responding to the FBI's request, THORChain technical co-founder Chad Barraford said node operators had “zero information that isn't already public and readily available in real time” and predicted the hackers “will be consistent and resume trading as normal.”
North Korea denied involvement on Nov. 3. Kim Yo Jong, sister of leader Kim Jong Un and a party Central Committee director, said via the Korean Central News Agency that the FBI's claim was “absurd rhetoric” and “a grave political provocation,” adding that Washington made similar accusations a year earlier over the Bybit hack.
By Tuesday, Binance said $2.85 billion of the stolen funds, close to 44% of the theft, had been blocked, and 98% of affected customer balances had been reimbursed.
How much of the loot has already been laundered remains unclear, and analysts expect the final cash-out through over-the-counter brokers to stretch over months.
