THORChain Processes $46 Million in Stolen Binance Funds, Generating $200,000 in Fees

Highlights:

• Chainalysis says THORChain handled over $46 million in stolen Binance funds within 72 hours of the hack.
• THORChain generated more than $200,000 in fees, while hackers moved nearly $4 million through Wasabi Wallet.
• Despite FBI warnings, crypto services continued processing stolen funds, with nearly $3 billion still under hacker control.

Cross-chain protocol THORChain processed more than $46 million in cryptocurrency stolen from Binance within three days of the October 29 hack. Blockchain analytics firm Chainalysis found that these transfers generated over $200,000 in fees for the network’s operators. The hackers also used Wasabi Wallet to move nearly $4 million in Bitcoin, making the funds harder to trace.

According to a November 8 report by The Wall Street Journal, the attackers began moving funds within minutes of the $6.3 billion theft. Chainalysis found that they spread the assets across more than 10,000 cryptocurrency wallets and used different services to move them between networks.

据《华尔街日报》报道，Chainalysis 估算，在币安遭黑客攻击后的 72 小时内，跨链协议 THORChain 处理了超过 4600 万美元被盗资金，产生逾 20 万美元手续费。此前在 2025 年 Bybit 遭盗事件中，THORChain 处理了近 10 亿美元被盗资金，Chainalysis 估计其运营者至少获得 1200 万美元手续费。THORChain…

— 吴说区块链 (@wublockchain12) November 9, 2026

THORChain Earns Fees as Hackers Move Stolen Binance Funds

THORChain allows users to exchange cryptocurrencies across different blockchains. The Binance hackers used the protocol to convert stolen assets and move them between networks. Meanwhile, Chainalysis found that nearly $4 million in stolen Bitcoin passed through Wasabi Wallet during the same 72-hour period. The service uses a mixing feature that makes it harder to identify the source of Bitcoin transactions.

Both services continued handling transactions linked to the attack after the FBI urged cryptocurrency platforms to block the stolen funds. Developers behind decentralized protocols argue that they cannot always stop individual transactions. Some also believe they should not interfere with how people use their networks.

However, Nick Carlsen, a former FBI analyst who now works at TRM Labs, questioned THORChain’s claims of decentralization. He argued that the protocol remains more centralized than its developers suggest and generates substantial revenue from suspicious transfers.

THORChain Previously Earned $12 Million From Bybit Hack Transfers

The Binance theft is not the first major hacking case involving THORChain. Following the February 2025 Bybit hack, attackers used the protocol to process nearly $1 billion in stolen cryptocurrency. Chainalysis estimated that THORChain operators earned at least $12 million in fees from those transfers.

THORChain co-founder John-Paul Thorbjornsen defended the platform’s fee structure. “All blockchain protocols make fees from usage,” he told The Wall Street Journal. Thorbjornsen also said he no longer plays an active role in THORChain. He explained that developers had removed a disputed administrative key and that 111 nodes now operate the network. However, the number of individuals controlling those nodes remains unclear.

Nearly $3 Billion in Stolen Binance Funds Remains With Hackers

The FBI previously called on cryptocurrency service providers, including THORChain node operators, to block transactions connected to the Binance hack. Stablecoin issuers Tether and Circle also took action. They blacklisted addresses linked to the theft, helping freeze roughly half of the stolen assets within hours of the attack.

Meanwhile, blockchain analytics firm Elliptic reported that approximately $3.13 billion in stolen Binance funds remained in wallets linked to the hackers as of November 7, mostly in Bitcoin and Ethereum. Another $2.85 billion had been frozen or seized. Elliptic said the attackers had left their main Bitcoin holdings and most of the stolen ETH untouched.

The case has raised further questions about how much responsibility decentralized crypto platforms should carry when hackers use their services to move stolen funds.