RUNE Token Surges 13% Following Binance's Historic $6.3B Security Breach

RUNE Token Surges 13% Following Binance's Historic $6.3B Security Breach

THORChain has been previously utilized by North Korean threat actors to transfer assets stolen from cryptocurrency exchanges Bybit and Bitget, leading to demands for protocol intervention.

The value of THORChain's RUNE cryptocurrency experienced an increase exceeding 13% on Friday following Binance's confirmation of a security breach totaling $6.3 billion.

The RUNE token reached a price point of $0.67 during the time of publication, marking a significant rise from its recent bottom of $0.59 recorded at 12:20 a.m. UTC, based on information from TradingView data.

Blockchain sleuth ZachXBT disclosed on Friday that cryptocurrency assets taken from Binance along with those from September's Bitget security incident had been routed through THORChain prior to being consolidated at an identical Ethereum wallet address.

According to ZachXBT's findings, the Bitget breach had been traced back to TraderTraitor, a group with connections to North Korea. Both TRM Labs and Chainalysis have similarly connected the Binance security breach to this organization.

The THORChain protocol enables its users to exchange digital assets between different blockchain networks. North Korean threat actors have historically leveraged the protocol for laundering cryptocurrency taken during the $1.4 billion Bybit security breach in February 2025. Additionally, the platform was utilized for moving stolen cryptocurrency from the $388 million Bitget hack.

In the aftermath of the Bitget security exploit, the exchange's CEO Gracy Chen made a public appeal to THORChain requesting they blacklist the wallet addresses belonging to the attackers, stating, "Decentralization is a design principle, not a shield for facilitating known stolen funds."

THORChain declined the appeal, explaining that the protocol lacks any technical capability to prevent individual token swaps from occurring. The protocol clarified that node operators possess the authority to suspend trading activity for a complete blockchain or throughout its entire network when addressing potential security threats.

The Bybit security incident additionally created divisions among protocol contributors when core development team member Pluto made public his decision to depart following the reversal of a trading suspension on Ether. Validator TCB issued warnings of leaving the protocol unless measures were implemented to stop the processing of funds connected to North Korean entities.

← Back to Blog