North Korean Hackers’ Stolen Funds Boost DeFi Protocol Revenue
Hundreds of millions of dollars in cryptocurrency stolen from Binance on October 30 appear to have generated significant revenue for several decentralized finance (DeFi) protocols, according to on-chain investigations.
Millions Laundered Through DeFi Services
An operation to launder the stolen funds generated over $100,000 in daily protocol revenue for at least five services, blockchain investigator dethective reported on November 2. The analysis linked revenues to wallets associated with North Korea, with SunSwap, THORChain, Relay, Symbiosis, and Chainflip emerging as the primary beneficiaries.
SunSwap reportedly earned $29,697 from the hacker’s activities, followed closely by THORChain with $28,184. Relay generated more than $23,000, while Symbiosis collected just over half that amount. Chainflip rounded out the top five, accumulating $7,433, bringing the total revenue for these five protocols to $101,144.
The revenue surge was particularly pronounced for THORChain and Relay, which saw their daily earnings increase by 2,229% and 1,954%, respectively, compared to typical October figures. SunSwap experienced an 815% jump, while Symbiosis and Chainflip posted gains of 358% and 194%.
Methodology and Potential Omissions
Dethective stated that the figures were compiled using data from Elliptic and FBI hack lists, along with additional traced wallets. The investigation also accounted for all Tron transfers between October 29 and November 1, with revenue calculated according to DeFiLlama’s methodology.
However, the investigator noted a potential omission: a router contract named BWSwapRouterV1, which may have processed approximately $175,000 across 3,561 swaps involving about $58 million. This was excluded due to uncertainty about its direct link to the Binance attacker.
Tracing the Stolen Funds
A separate investigation by SomaXBT traced some $242 million moved through the Tron network over two days. This represents a fraction of the $628 million originally stolen, with Tether having frozen over $378 million in USDT. On-chain analysts estimate that more than $3 billion in stolen funds remain untouched across other blockchains.
THORChain served as the largest exit route for the $242 million, facilitating the movement of over $48 million. According to SomaXBT, the hackers ultimately received $42.7 million, incurring $5.7 million in fees and slippage. Interfaces involved in these transactions collected approximately $95,000 in affiliate fees.
On November 1, the FBI officially attributed the Binance hack to North Korea’s Lazarus Group, also known as TraderTraitor. Relay, which had seen minimal activity in previous attacks linked to this actor, reportedly handled a substantial portion this time, sending approximately $48 million to Ethereum, Bitcoin, and the Lighter decentralized exchange. SomaXBT also traced $32.1 million and $16.0 million processed through Chainflip and Symbiosis, respectively.
Leave a Reply