# Stolen Binance Funds Boost DeFi Protocol Revenues North Korean hackers laundering stolen crypto assets generate significant fee spikes for decentralized protocols. - **Source:** [CryptoPotato](https://brifing.si/source/bd22636b-ec8d-42a8-8cca-1937c50e0f6c) - **Published:** 2026-11-02 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/b16f3249-23e8-4f5b-86eb-76409dce57f2 ## Laundering Triggers Revenue Spikes North Korean hackers moved hundreds of millions in stolen Binance funds, creating unexpected revenue for DeFi protocols. On-chain data indicates five specific services generated over $100,000 in daily revenue from these laundering operations. This activity highlights how illicit fund movement directly impacts the financial performance of decentralized exchange platforms. ## Top Beneficiary Protocol Breakdown SunSwap led the group with $29,697 in attributed revenue, followed closely by THORChain at $28,184. Relay collected over $23,000, while Symbiosis and Chainflip rounded out the top five. These figures, calculated using DeFiLlama definitions, reflect the immediate financial gain protocols experienced while processing transactions linked to the Binance hack. ## Extreme Percentage Revenue Growth The revenue surge was most dramatic at THORChain and Relay, which saw daily gains of 2,229% and 1,954% respectively compared to October averages. SunSwap recorded an 815% increase, while Symbiosis and Chainflip saw growth of 358% and 194%. These spikes underscore the massive volume of illicit capital moving through these specific liquidity pools. ## Methodology of On-chain Investigation Investigator dethective utilized Elliptic and FBI hack lists alongside traced wallet addresses to map the flow of funds. The analysis included every Tron transfer between October 29 and November 1. One potential entry, BWSwapRouterV1, was excluded from the final total due to uncertainty regarding its direct link to the attacker. ## Scale of Tron Network Activity SomaXBT traced approximately $242 million moving through the Tron network within two days. This represents a portion of the $628 million originally stolen, as Tether successfully froze over $378 million in USDT. Analysts estimate that more than $3 billion in stolen funds currently remains untouched across various other blockchain networks. ## THORChain as Primary Exit Route THORChain functioned as the hacker's largest exit route, processing over $48 million of the traced funds. The attackers ultimately received $42.7 million after losing $5.7 million to slippage and protocol fees. Additionally, various interfaces facilitating these specific transactions collected approximately $95,000 in affiliate fees during the rapid laundering process. ## Attribution to TraderTraitor Group On November 1, the FBI officially attributed the Binance hack to the North Korean actor known as TraderTraitor. Relay, which previously saw minimal interaction with this group, handled a significant $48 million chunk this time. These funds were bridged into Ethereum, Bitcoin, and the Lighter decentralized exchange to further obfuscate the trail. ## Implications for DeFi Security The incident demonstrates how decentralized protocols inadvertently profit from high-volume illicit transactions. While these platforms see temporary revenue spikes, the association with state-sponsored hacking groups poses significant regulatory and reputational risks. Future oversight must focus on how protocols handle large, suspicious inflows to prevent becoming essential infrastructure for global money laundering. ## Sources covering this story - https://cryptopotato.com/stolen-binance-funds-drive-defi-protocol-revenue-gains-investigator/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._