- Trending
- Comments
- Latest
Five DeFi protocols earned an estimated $101,144 in fees from laundering linked to the Binance hack, with Thorchain’s daily revenue 2,229% above its October average, according to on-chain investigator Detective.
The Federal Bureau of Investigation (FBI) attributed the theft of more than $6 billion from Binance to North Korea-linked hacking group TraderTraitor in an announcement on October 31. The bureau said the stolen assets were being converted primarily into Ethereum and moved through DeFi services and instant-exchange platforms to conceal their origins.
The development highlights a challenge facing decentralised financial infrastructure: protocols can generate substantial transaction fees from illicit fund movements even when they are not directly involved in the underlying theft.
An on-chain investigation by blockchain investigator Detective identified five major DeFi protocols that generated fees from transactions associated with the Binance Hack between October 29 and November 1.
The analysis focused on transactions involving Tron addresses previously identified by blockchain analytics firm Elliptic and the FBI. Transactions without a sufficiently established connection to the hackers were excluded from the final estimates.
Sunswap recorded the largest estimated fee income at $29,697, followed by Thorchain with $28,184 and Relay with more than $23,000.
Symbiosis generated over $10,000, while Chainflip collected approximately $7,433.
Although the combined revenue remained relatively small compared with the wider DeFi industry’s earnings, the percentage increases were considerably higher than the protocols’ normal activity.
Thorchain’s daily revenue climbed 2,229% above its October average. Relay recorded a 1,954% increase, while Sunswap’s revenue rose 815%.
Symbiosis and Chainflip also experienced increases of 358% and 194%, respectively.
The revenue spike was largely driven by the mechanics of cross-chain transactions. As hackers converted stolen assets into other cryptocurrencies and moved them between blockchain networks, each swap or bridge transaction generated fees for the protocols facilitating the transfers.
These platforms typically charge users for providing liquidity, exchanging tokens or facilitating transactions between otherwise separate blockchain ecosystems.
Consequently, the same infrastructure that supports legitimate cryptocurrency trading can also generate revenue when used to move stolen assets.
The investigation also identified a separate swap-routing smart contract, BWSwapRouterV1, which processed approximately $58 million across 3,561 transactions.
The contract may have collected an estimated $175,000 in fees. However, investigators could not establish a confirmed connection between its transactions and the stolen funds. As a result, its estimated revenue was excluded from the $101,144 total.
A separate investigation by on-chain analyst SomaXBT revealed the scale of the fund movements associated with the Binance Hack.
According to the analysis, approximately $242 million moved through Tron over two days, with roughly $194 million subsequently transferred to other blockchain networks through cross-chain services.
Relay handled approximately $48 million of the cross-chain outflows, while Thorchain processed about $44 million.
Chainflip accounted for another $32.1 million, and Symbiosis facilitated approximately $16 million.
These figures measure transaction volumes rather than protocol revenue, making them different from the fee estimates published by Detective.
The cross-chain platforms have become important components of the laundering process because they allow users to convert and transfer digital assets between different blockchain networks without relying on a single centralised intermediary.
However, the services still collect transaction fees, creating a financial incentive from the increased trading activity regardless of whether the transactions originate from legitimate users or illicit actors.
The FBI’s October 31 announcement identified TraderTraitor as the group responsible for the theft of more than $6 billion in digital assets from Binance.
The bureau linked the hacking group to North Korea and said the stolen assets were being converted primarily into Ethereum before being moved through DeFi platforms and instant-exchange services.
The FBI has called on Thorchain node operators and other DeFi service providers to block transactions involving wallets associated with the investigation.
Node operators maintain the infrastructure that supports Thorchain’s decentralised network, making their cooperation relevant to efforts aimed at restricting the movement of identified stolen assets.
However, the effectiveness of these interventions remains a concern.
Chainflip disclosed that some funds initially blocked by its security systems were refunded to newly created addresses before being sent back through the platform.
Some of the subsequent transactions passed its security screening, exposing a weakness in how refund addresses were being monitored.
The company said it had since upgraded its systems to associate refund addresses with the original source of funds, allowing its detection mechanisms to identify transactions attempting to re-enter the platform.
The laundering operation has also extended beyond Tron and Ethereum, with the movement of stolen XRP emerging as another significant development.
An update published on November 3 at 09:54 UTC revealed that the attacker had transferred all 233.46 million stolen XRP into six newly created wallets.
At the time of the reported transaction, the holdings were valued at approximately $294 million, based on an XRP price of around $1.26.
Ledger records showed that the original holding address first conducted six test transactions of 1,000 XRP each, beginning at 03:47 UTC on Monday.
Between 03:52 and 04:00 UTC, the address subsequently transferred the remaining holdings through nine large transactions.
Five of the newly created wallets received approximately 40 million XRP each, while the sixth received the remaining 33.46 million XRP. The original address was left with just 23.7 XRP.
The movement presents a different challenge for investigators because native XRP does not have an issuer-controlled freezing mechanism comparable to that available for certain stablecoins.
Ripple, however, froze stolen RLUSD associated with the breach.
On-chain trackers also reported that approximately $250,000 of the stolen funds had reached cryptocurrency exchange Gate within a 12-hour period.
As of the Tuesday ledger snapshot referenced in the report, none of the six newly created wallets had transferred funds out.
The XRP movement demonstrates how attackers can distribute stolen assets across multiple addresses, potentially complicating efforts to trace and restrict subsequent transactions.
Despite the substantial percentage increases recorded by the affected protocols, the additional revenue remains relatively modest compared with the earnings of larger DeFi platforms.
Thorchain’s estimated $28,184 in fees, for instance, represents a small amount compared with leading protocols that generate millions of dollars in weekly revenue. Papertrade’s seven-day protocol revenue had recently declined to approximately $8.5 million.
The significance of the Binance Hack therefore lies less in the absolute amount earned by individual protocols and more in how illicit transactions can produce sharp increases in their daily revenue.
The incident also raises questions about the ability of decentralised platforms to identify and prevent the movement of stolen funds without compromising their underlying operations.
While the FBI has urged service providers to restrict transactions associated with the investigation, Chainflip’s disclosure illustrates how blocked funds can potentially re-enter a platform through newly generated refund addresses.
The challenge becomes more complicated when attackers distribute assets across multiple wallets, convert them into different cryptocurrencies and move them through several blockchain networks.
Copyright © 2025 - The Bit Gazette.
