North Korean Hackers Used This Protocol to Launder Bybit's Billions, Now It's Up 13%

North Korean Hackers Used This Protocol to Launder Bybit's Billions, Now It's Up 13%

The same protocol North Korean state hackers used to move stolen Bybit and Bitget funds just pumped 13% in the wake of Binance's record $6.3 billion hack, and traders are piling in anyway.

THORChain's RUNE surged hard after news broke of the largest exchange hack in crypto history, a move that should have triggered alarm bells but instead triggered buy orders. The timing is not a coincidence. When billions move illegally through crypto, the bridges and cross-chain swap protocols that make censorship-resistant transfers possible become the hottest addresses in the room.

And THORChain has been that room before.

The Laundromat Nobody Could Shut Down

After North Korea's Lazarus Group drained Bybit and Bitget, blockchain investigators watched helplessly as stolen funds flowed through THORChain at scale. Calls came fast and loud for the protocol to intervene, to freeze routing, to block suspicious addresses, to do something. THORChain's decentralized structure made that nearly impossible by design. The protocol processed the transactions anyway.

That controversy never killed the token. If anything, it proved THORChain's core value proposition to a certain class of user: it works, no matter what.

Why Traders Are Buying Into a Hack Story

Here is the brutal market logic playing out in real time. When a major exchange gets hit, liquidity scatters. Traders and bad actors alike need infrastructure to move assets across chains quickly and without gatekeepers. THORChain is one of the few protocols that has proven it can handle that volume without buckling or bowing to political pressure.

The 13% jump reflects traders pricing in increased protocol usage, not endorsing the hack. Volume through THORChain tends to spike during periods of market chaos, and right now, crypto is in maximum chaos mode.

The Part That Should Make You Uncomfortable

Regulators have been circling cross-chain swap protocols for months. The Binance hack will accelerate those conversations dramatically. If investigators confirm that stolen funds from the $6.3 billion breach moved through THORChain, the protocol faces a political and legal heat it has never seen at this scale. That is not a small risk to hold through a 13% pump.

What to Watch

Track on-chain flow data for RUNE over the next 48 to 72 hours. If volume spikes confirm the price action, the pump has legs in the short term. But watch for any wallet-level sanctioning from OFAC or coordinated node-operator pressure to restrict routing. Either event could unwind this rally instantly.

Holding RUNE right now means betting that decentralization wins against regulatory pressure, again. It has before. The odds of that staying true are getting shorter every hack cycle.