DeFi

Symbiosis

Millions

THORChain

Chainflip

Several DeFi protocols seem to have benefited from North Korean hackers moving hundreds of millions of dollars’ worth of crypto they stole from Binance on October 30.
On-chain investigations suggest that the laundering operation generated more than $100,000 in protocol revenue per day for five services.
<h2 id="thorchain-relay-and-sunswap-among-biggest-beneficiaries">THORChain, Relay and SunSwap Among Biggest Beneficiaries</h2>
Blockchain investigator dethective, on November 2, <a href="https://x.com/dethective/status/2117029174221193255?a=rZuVzBnq7EhzrwRW0sg&amp;s=20" rel="noopener noreferrer nofollow">posted</a> a breakdown of protocol revenues linked to wallets associated with the Democratic People’s Republic of Korea (DPRK), with SunSwap, THORChain, Relay, Symbiosis, and Chainflip making the most money.
Per the data, SunSwap generated $29,697 attributed to the hacker, while THORChain, in second place, earned $28,184. On its part, Relay earned slightly more than $23,000, while Symbiosis made just over half of that. Chainflip wrapped up the top five, collecting $7,433 to bring the total for them to $101,144.
The increase in revenue was most pronounced at THORChain and Relay, whose daily revenues went up 2,229% and 1,954%, respectively, compared with typical October levels. SunSwap recorded an 815% jump, while Symbiosis and Chainflip posted gains of 358% and 194%.
According to dethective, the figures are based on Elliptic and FBI hack lists, as well as some additional wallets that had been traced on-chain. They also counted every Tron transfer between October 29 and November 1, with revenue calculated using DeFiLlama’s definition of what each protocol remains with.
However, the investigator pointed out that they had left out one possible entry since they weren’t 100% certain of their link to the Binance attacker: a router contract named BWSwapRouterV1, which may have collected approximately $175,000 across 3,561 swaps that involved about $58 million.
<h2 id="thorchain-and-relay-processed-millions-in-stolen-funds">THORChain and Relay Processed Millions in Stolen Funds</h2>
A separate investigation by SomaXBT <a href="https://x.com/somaxbt/status/2116884703655723207?a=osy6aAAeZo_di2qakRE&amp;s=20" rel="noopener noreferrer nofollow">traced</a> some $242 million moved through the Tron network in two days, a small chunk of the $628 million the attacker had originally stolen on the network, with Tether freezing over $378 million of it in USDT. According to on-chain analysts, there is still more than $3 billion in stolen funds that’s untouched across other blockchains.
THORChain was the hacker’s largest exit route for that $242 million, as they used it to move over $48 million. According to SomaXBT’s investigations, the hackers ultimately received $42.7 million, having lost $5.7 million to fees and slippage, with interfaces facilitating those transactions collecting about $95,000 in affiliate fees.
On November 1, the FBI formally <a href="https://cryptopotato.com/binance-starts-withdrawal-recovery-as-fbi-blames-north-korea-for-6b-hack/" rel="noopener noreferrer nofollow">blamed</a> the Binance <a href="https://cryptopotato.com/binance-suffers-6-3-billion-hack-pledges-to-cover-all-user-losses/" rel="noopener noreferrer nofollow">hack</a> on North Korea’s TraderTraitor, and Relay, which in past attacks linked to this particular actor barely saw any action, this time is reported to have handled a pretty sizable chunk, sending approximately $48 million into Ethereum, Bitcoin, and the Lighter decentralized exchange. SomaXBT says they also traced $32.1 million and $16.0 million processed through Chainflip and Symbiosis, respectively.
The post <a href="https://cryptopotato.com/stolen-binance-funds-drive-defi-protocol-revenue-gains-investigator/" rel="noopener noreferrer nofollow">Stolen Binance Funds Drive DeFi Protocol Revenue Gains: Investigator</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Stolen Binance Funds Drive DeFi Protocol Revenue Gains: Investigator

Table of Contents

CryptoPotato_News

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!