North Korean Hackers Launder $242M of Binance Loot via Tron in Two Days

Hackers tied to North Korea have laundered roughly $242 million of the funds stolen from Binance through the Tron blockchain in just two days, onchain analyst and Security Alliance (SEAL) contributor SomaXBT said Sunday on X, as the FBI presses THORChain and other infrastructure providers to block the transactions.

The attackers took about $628 million from Binance on Tron and had roughly $249 million left to move after Tether froze 378.7 million USDT, SomaXBT said. Of the $242 million already laundered, about $194 million left Tron through bridges and swap services. Another $26 million stayed on the network, while roughly $22 million went to fees, slippage and price moves.

The FBI attributed the theft — about $6.3 billion in total, the largest crypto hack on record — to the TraderTraitor group in an alert issued Saturday jointly with the U.S. Secret Service and IRS Criminal Investigation. A 2022 advisory from the FBI, CISA and the Treasury Department describes TraderTraitor as a North Korean state-sponsored group, active since at least 2020, tracked by the industry under names including Lazarus Group, APT38 and BlueNoroff. The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.

Which bridges moved the money?

Four protocols handled about $140 million of Tron outflows, per SomaXBT: Relay with $48 million, THORChain with $44 million, Chainflip with $32.1 million and Symbiosis with $16 million. Bitget Wallet processed another $41.7 million, with the final destination still unresolved.

The FBI urged THORChain's THORNode operators, RPC node operators, instant exchanges and DeFi services to block transactions tied to the theft, and published 608 Ethereum addresses, 19 bitcoin addresses and one Solana address. No Tron addresses made the list. THORChain technical co-founder Chad Barraford wrote on X that "THORNode operators have zero information that isn't already public and readily available in real time," adding, "No subpoenas required, a best case scenario for investigations." He did not say whether operators would block the listed addresses.

An Ethereum reorg earlier Saturday caused THORChain to double-refund a 10 ETH deposit, triggering an emergency pause that halted all swaps, Chainalysis said. As of 1:20 p.m. ET Sunday, trading remained frozen on 10 of THORChain's 13 connected chains, including Tron, Ethereum and Bitcoin — with Tron halted since midday Saturday. Before the pause, the attackers had pushed 185.1 million TRX and 3.83 million USDT into THORChain across 2,697 deposits; the protocol paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses. Front-end interfaces earned about 145,800 RUNE, roughly $95,000, in affiliate fees.

Relay received 37.64 million USDT and 39.28 million TRX in 735 deposits despite screening addresses with Chainalysis data and an internal blocklist. Analyst Specter said $38 million bridged through Relay in seven hours. Etherscan data shows one wallet received 2,804 ETH and 1.02 million USDT from Relay's router in 97 payments over 80 minutes, then routed about 3,257 ETH, roughly $7.4 million, to four new addresses — none of them on the FBI's list. On Sunday, the hackers also began swapping 970,522 SOL, about $95.9 million, for bitcoin through Relay, Lookonchain reported, using the only Solana address the FBI had listed the day before.

Chainflip received 49.47 million USDT in 571 deposits, with failed swaps refunded to fresh wallets and resent — 17.91 million USDT in all. Symbiosis, which took in 49.71 million TRX across 1,367 deposits, admitted its controls lagged: "Our screening is built for normal flows, not for tracking fast-moving, sophisticated attempts so some mechanisms have gaps," the protocol said on X. "We're closing them as we go."

Laundering on autopilot

Elliptic said the main Tron distribution wallet paid out hourly for 31 straight hours, never pausing longer than 46 minutes, with one swap size recurring 19 times. Co-founder Tom Robinson said the pattern does not suggest AI agents: "The same sizes, the same rhythm, the same routes, hour after hour" point to "operators making decisions, with scripts doing the repetitive work."

Elliptic has verified $2.85 billion of the stolen funds as frozen or seized — about 44% of the $6.43 billion it counts as stolen, 94% of it stablecoins. Nothing has been frozen on Bitcoin, XRP Ledger, Solana or NEAR, and about $3.25 billion, including 18,327 BTC and 233 million XRP, sits in assets no issuer can freeze. Chainalysis said the hackers are also depositing stablecoins into a Tron DeFi protocol for unfreezable depository receipt tokens — identified by other analysts as JustLend — and redeeming them from fresh addresses.

With THORChain still paused, roughly $249 million unmoved on Tron, and the FBI's address list now public, the coming days will test whether bridges and node operators enforce the blockade voluntarily or let the remaining funds slip through.