Binance Hackers Move $124m Into Bitcoin Through THORChain

Attackers behind the roughly $6.43 billion theft of digital assets from Binance have laundered at least $124 million in stolen tokens into bitcoin through the THORChain swapping protocol, on top of the $1.48 billion in bitcoin stolen directly, according to blockchain-research firm Elliptic's latest update — a laundering system that spans more than 20,000 wallets across 16 blockchains and roughly 65,000 transactions.

The funds trace to North Korea, according to the FBI's TraderTraitor designation and analyses from TRM Labs and Chainalysis, which assessed the attribution with high confidence — making the Binance breach the largest cryptocurrency theft in history and its follow-through a live, seven-day-a-week operation in digital money laundering. Binance says users have lost nothing de facto: about 98 per cent of the affected tokens have already been replenished with the exchange's own accounts, with co-CEO Richard Teng telling CNBC the company funds the gap and no user bears the loss.

How the breach actually entered

Binance's own postmortem, published Nov 3, is unusually detailed for a theft of this magnitude, and it reads like an espionage playbook. The campaign reportedly began in June, when a tampered installer of Homebrew — a popular developer tool for Mac systems — was planted where affected users would find it through search engines. The second vector came in September, with fake job-recruitment interviews staging a fictional "project director" role, in which an official-looking coding assignment contained zero-day malware that replaced the developer tool pyenv on target machines.

The actual intrusion was completed Oct 20 through a compromised internal AI tool inside Binance, and the funds were moved out of the exchange from 20:05 UTC on Oct 29 — with containment achieved only at 00:10 UTC on Oct 30. The technical failure at the heart of the gap was a design choice on the hot wallet: an EIP-7702 authorisation mechanism on the MPC signing architecture meant that no single keyholder could revoke the attacker's authorisation, extending the window in which the theft proceeded unchecked.

The laundering machine's shape

Elliptic's tracking shows the movement of stolen assets is industrial in scale. Beyond the $124 million in bitcoin swaps through THORChain, roughly $50 million of XRP had been swapped by the close of Friday, with about $226 million remaining against the tokens' starting position. Nearly all the stolen Solana had already been mixed or swapped into less-traceable forms. In all, about $3.11 billion of the stolen assets sit in linked addresses, while $2.85 billion has been frozen — meaning the majority of the take remains in place rather than cashed out.

"The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," Elliptic said in response to speculation that agentic AI had been used to orchestrate the flows. That caution itself carries weight for the risk discipline: the state's operational tradecraft is human-engineered, with automation as the multiplier — a security line that compliant exchanges andvalidators can act on now, without waiting for a new threat model to be confirmed.

The exchange-system consequences

The operational consequences continue to ripple through the crypto market a week after the theft. Withdrawals for HYPE, INJ, APT, PLASMA, NEAR and Litecoin — and all tokens on the affected networks — are set to come back "by the end of next week," Binance said on Friday, restoring full withdrawal functionality in unfulfilled installments. The exchange has commissioned an independent security review and says it has blocked 57 North Korea-linked attempts so far this year; Teng told CNBC the company's opening assessment of the attackers was that they "spent months building their way in."

Market pricing has been unforgiving despite the exchange's funding of the shortfall. Bitcoin slid roughly 2 per cent to about $73,708 — its lowest level since August — and ether dropped 5 per cent to around $2,223 over the Monday session, with traders connecting the pressure to the breach's timing, the lingering withdrawal suspension and the general risk-off mood toward digital assets after a week in which hacked-value headlines have dominated the sector.

What this means for African exchanges and corporate treasurers

The African regulatory angle is immediate. Markets where local players are scaling exchange licences — Nigeria's stablecoin corridors, South Africa's licensed crypto intermediaries, Kenya's digital asset sandbox — will read the Binance postmortem as a specific damage-limitation study: the attacker's initial access came through developer tooling and recruitment channels, the vectors a fintech startup work environment surrounded by energetic junior engineers encounters daily. Exchanges and payment firms across Johannesburg, Lagos and Nairobi are repeating the exercise now: multi-signature privilege on treasury key-management systems, staff screening of developer tools, and rehearsed revocation playbooks for authorisation leaks.

The broader lesson for treasurers and finance ministries is that digital-asset theft has become an organised, state-sponsored method of hard-currency acquisition rather than a lone-hacker phenomenon that depends on regulatory clarity gaps. North Korea's Unit existential hacking programme and other state-backed groups treat crypto exchange infrastructure as the cheapest credible channel for earning dollars in a sanctions-constrained environment — meaning the exchange-level risk mass-cutting procedures and regime of AI-tooling checks this year are about to face the same questions that border-procedures and currency-flow controls once did for the global financial system.

The post-breach trajectory of Binance — the withdrawal recovery, the independent review, the markets' response — will settle how this breach is remembered: a path-breaking theft that cost users nothing thanks to cover from finance, or the opening incident that redrew custody, security and compliance risk pricing for a global crypto market that had been bulking up on AI-tool-driven optimism.