Stolen Binance Funds Flow Through DeFi Protocols

DeFi Protocols Profit From Hack

SunSwap collected $29,697 in fees while THORChain earned $28,184 as North Korean hackers moved capital stolen from Binance on October 30. Public on-chain data posted November 2 by investigator dethective showed five major services split more than $100K in daily revenue from the routing operations. Relay gathered slightly above $23,000, Symbiosis collected roughly half that amount, and Chainflip finished the top tier by bringing in $7,433. The illicit volume generated a total of $101,144 for those specific platforms during the brief wash window.

Daily revenue metrics spiked aggressively across every beneficiary during the routing surge. THORChain revenues jumped 2,229% compared against standard October baselines. Relay posted a 1,954% increase over normal operational metrics. SunSwap recorded an 815% jump in daily fee collection. Symbiosis and Chainflip posted gains of 358% and 194% respectively. The figures rely entirely on Elliptic data feeds and FBI hack lists.

THORChain Processes Millions in Exit

A separate investigation published by SomaXBT revealed $242M moved across the Tron network within forty-eight hours from a total pool of $628M stolen during the initial exploit. Tether froze over $378M USDT of the compromised assets before final deployment. On-chain analysts noted that more than $3B in illicit digital assets remains untouched across alternative blockchains. THORChain served as the primary exit route for the $242M batch, moving over $48M in short order.

Hackers pocketed $42.7M after losing $5.7M to network fees and severe slippage. Trading interfaces facilitating the routing process collected about $95,000 in affiliate commissions. The FBI officially attributed the exploit on November 1 to the North Korean state-sponsored group TraderTraitor. Relay processed approximately $48M into native Ethereum, Bitcoin, and the Lighter DEX. Chainflip and Symbiosis handled $32.1M and $16.0M respectively.