REALITY CHECK | Why the Binance Hacker Passed Funds via THORChain

A cross-chain trail linked to the latest Binance hack has renewed scrutiny of THORChain, the protocol that can move assets across blockchains without centralized exchange approval. After the Binance incident, on-chain investigator ZachXBT reported that funds related to the exploit passed through THORChain before being consolidated at an Ethereum address also associated with September’s $387.5 million Bitget hack. THORChain’s permissionless design makes it harder for platforms to intervene once stolen funds enter its liquidity. The article notes a similar pattern in the Bitget case, where attackers converted stolen assets into Bitcoin and moved about $83 million in stolen XRP across multiple wallets. It also highlights a recovery limitation: Ripple cannot freeze native XRP in attacker-controlled wallets. The protocol declined to block identifiable attacker-linked addresses, fueling disputes about whether decentralization should prevent censorship of criminal flows.