RUNE rose about 10% as THORChain restarted cross-chain swaps, while Binance attackers reportedly used the network to convert stolen assets into Bitcoin.
According to CoinDesk, THORChain’s native token, RUNE, had gained about 10% over the past 24 hours at the time of publication. The network’s return to operation also reopened a swap channel used to move funds stolen from Binance.
THORChain enables swaps between assets on different blockchains without opening an account on a centralized exchange. These transactions generate fees for the network, while RUNE is paired with other assets in liquidity pools and used to settle transactions.
Why had transactions stopped?
The network halted transactions on October 31 because of a refund bug that emerged during a reorganization of blocks on Ethereum. The refund of 10 ETH that a vault had never actually received led to the pause in transactions.
Blockchain analytics firm Chainalysis said the outage also delayed the attackers’ movement of the stolen funds. Since transactions resumed, the funds have continued to be converted into Bitcoin through THORChain.
Attackers accept losses as they move into Bitcoin
Lookonchain reported that the attackers split the stolen SOL among different wallets and converted it into USDC, then acquired ETH with assets they moved to the Ethereum network. This ETH is being swapped for Bitcoin through THORChain.
According to on-chain researcher SomaXBT’s analysis dated November 1, the attackers made swaps worth approximately $48.3 million through THORChain and received about $42.7 million in return. The researcher calculated that the loss reached approximately 12% due to transaction fees and unfavorable price movements during the swaps.
This conversion makes efforts to freeze the funds more difficult: while the issuers of USDT and USDC can freeze their own tokens, there is no issuer on Bitcoin or Ethereum that can unilaterally freeze wallet balances.
The funds have not gone untraced
The FBI attributed the October 29 Binance attack to the North Korea-linked TraderTraitor group and asked crypto service providers to block transactions involving associated addresses. Elliptic, which previously examined the overlapping movements of funds from the Binance and Bitget attacks, notes that the transfers can be traced through public blockchain records.
According to Elliptic’s assessment, only a very small portion of the assets stolen from Binance was likely converted to cash; most of the activity consists of moving funds between addresses linked to the attack. The company expects the attackers to continue converting ETH into BTC in smaller transactions and to try to cash out through over-the-counter brokers in the coming months.
Binance said in a statement on Tuesday that approximately $2.85 billion had been frozen and that approximately 98% of the affected tokens had been replaced using company resources.
Not investment advice.