THORChain RUNE Token Rises Amid Hacker Activity
The RUNE token saw a 13 percent increase following reports that hackers used the protocol to launder stolen digital assets.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Should decentralized finance protocols be required to block transactions linked to stolen assets?
THORChain token RUNE rose 13 percent after investigator ZachXBT linked the protocol to funds stolen in major hacks at Binance, Bitget, and Bybit. These illicit funds reportedly converged at a single Ethereum address.
Why it matters
The association with high-profile hacks highlights ongoing security concerns regarding cross-chain protocols that facilitate asset movement. Because THORChain lacks a mechanism to block individual swaps, its infrastructure has become a focal point for tracing stolen capital.
THORChain allows users to swap assets across multiple blockchains, creating a cross-chain liquidity environment. While the network architecture lacks an individual swap-blocking mechanism, node operators maintain the authority to pause trading across the entire network.
The players
ZachXBT
An on-chain investigator known for publicizing digital asset theft and tracing illicit financial activity across blockchain networks.
THORChain
A decentralized cross-chain liquidity protocol that enables users to swap native assets across different blockchain networks.
Binance
A major global cryptocurrency exchange that recently confirmed a significant security breach involving billions of dollars.
Bybit
A digital asset exchange that was the subject of a massive security compromise involving $1.4 billion in assets.
Bitget
A crypto exchange platform that reported a $388 million hack in 2026.
The details
Investigator ZachXBT connected stolen assets from a $6.3 billion Binance breach, a $388 million Bitget hack, and a $1.4 billion Bybit exploit to the THORChain protocol. Despite these findings, the platform's decentralized nature limits its ability to restrict specific transactions.
Timeline
February 2025: Bybit hack occurred.
September 2026: Bitget hack occurred.
October 30, 2026: RUNE token value rose 13 percent.
The Tech Race
The incident demonstrates the ongoing arms race between blockchain investigators and the decentralized protocols used to obfuscate stolen digital assets. This movement underscores the vulnerability of cross-chain bridges, which are increasingly replacing traditional centralized tumblers in cybercrime operations.
Users of decentralized exchanges should be aware that protocol-wide trading pauses, initiated by node operators, may temporarily restrict liquidity and transaction capabilities. Additionally, the association of a protocol with large-scale hacks can lead to increased regulatory scrutiny and potential platform instability.
The takeaway
Blockchain users should conduct thorough due diligence on the security protocols and governance structures of the platforms they use for asset swapping. Diversifying assets across multiple platforms can help mitigate the impact if a specific liquidity provider experiences a protocol-wide shutdown.
Further reading
Learn more about evolving digital threats in our Cybersecurity section.
Live Poll
Should decentralized finance protocols be required to block transactions linked to stolen assets?
