North Korean hackers move $242 million of Binance loot off Tron as FBI presses THORChain

Hackers have laundered about $242 million of the funds stolen from Binance through the Tron blockchain in two days, according to onchain analyst SomaXBT, a contributor to the Security Alliance (SEAL). The movement is happening while the FBI urges cross-chain services to block transactions tied to the theft.

The FBI, together with the U.S. Secret Service and IRS Criminal Investigation, attributed the hack on Saturday to TraderTraitor, a North Korean state-sponsored hacking group. Binance lost about $6.3 billion on Thursday in what the source describes as the largest crypto hack on record.

Key numbers from the laundering operation

• About $242 million was laundered on Tron in two days, per analyst SomaXBT.
• The attackers took about $628 million from Binance on Tron and had roughly $249 million left after Tether froze 378.7 million USDT, a stablecoin tied to the US dollar.
• About $194 million left Tron through bridges and swap services, $26 million stayed on the network, and about $22 million went to fees, slippage and price moves.
• Relay handled $48 million of the outflows, THORChain $44 million, Chainflip $32.1 million and Symbiosis $16 million — about $140 million combined.
• Bitget Wallet handled another $41.7 million, but where that money ended up is still unresolved, according to SomaXBT.

What the FBI alert says

The FBI said the hackers were converting stolen assets "primarily into Ethereum" and expects further laundering through DeFi protocols and instant swap services. It urged THORChain's THORNode operators, along with RPC node operators, instant exchanges, DeFi services and other providers, to block transactions tied to the theft.

The agency published a list of 608 Ethereum addresses, 19 bitcoin addresses and one Solana address said to be linked to the attack. It listed no Tron addresses and did not disclose the evidence behind its attribution. Blockchain analysis firms Chainalysis, Elliptic and TRM Labs had already linked the theft to North Korea through onchain ties to earlier hacks.

A 2022 joint advisory from the FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department describes TraderTraitor as active since at least 2020 and says it steals and launders crypto "to support the North Korean regime." The industry also tracks the group as Lazarus Group, APT38 and BlueNoroff. The FBI also blamed TraderTraitor for the $1.5 billion Bybit hack in February 2025.

THORChain co-founder does not commit to blocking

THORChain, a service that lets users swap crypto across different blockchains, has not said whether its node operators will block the addresses the FBI listed. Technical co-founder Chad Barraford wrote on X on Saturday evening that "THORNode operators have zero information that isn't already public and readily available in real time." He added, "No subpoenas required, a best case scenario for investigations."

SomaXBT said the attackers sent 185.1 million TRX and 3.83 million USDT into THORChain in 2,697 deposits. THORChain has paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses. The attackers lost about 12% to fees and slippage, and front-end interfaces earned about 145,800 RUNE, roughly $95,000, in affiliate fees.

Separately, an Ethereum reorg on Saturday caused THORChain to double-refund a 10 ETH deposit, triggering an emergency pause, according to Chainalysis. The pause also stopped the hackers from swapping through most of THORChain's bridges. Trading remained halted on 10 of its 13 connected chains, including Tron, Ethereum and Bitcoin, as of 1:20 p.m. ET Sunday. Trading from Tron has been halted since around midday Saturday.

Relay, Chainflip and Symbiosis also move funds

Relay received 37.64 million USDT and 39.28 million TRX in 735 deposits, SomaXBT said. He noted the protocol "barely featured" in laundering from past TraderTraitor hacks. Onchain analyst Specter said Saturday that the hackers bridged $38 million through Relay in seven hours, even though Relay says it screens transaction addresses using third-party risk data, including from Chainalysis, and an internal blocklist.

Etherscan data shows one Ethereum address received 2,804 ETH and 1.02 million USDT from Relay's router and solvers in 97 payments over about 80 minutes on Saturday. The wallet swapped the USDT for ether on CoW Protocol and sent about 3,257 ETH, roughly $7.4 million, to four new addresses. None of the five addresses is on the FBI's list.

Lookonchain reported Sunday that the hackers began swapping 970,522 SOL, worth about $95.9 million, for bitcoin through Relay. Their Solana wallet — the only Solana address on the FBI's list — moved 486,970 SOL ($46.4 million) in the hour before Lookonchain's 5:35 a.m. ET post. The Relay-powered swaps began after the FBI listed the wallet on Saturday.

Chainflip received 49.47 million USDT in 571 deposits, but many swaps failed, SomaXBT said. Failed swaps were refunded to fresh Tron wallets and sent back in — 17.91 million USDT in all. Chainflip had planned an upgrade last year to block the Bybit hackers from its cross-chain exchange.

Symbiosis said early Sunday it had identified attempts to move Binance hack funds through its protocol and was in contact with Binance. "Our screening is built for normal flows, not for tracking fast-moving, sophisticated attempts so some mechanisms have gaps," Symbiosis said on X. "We're closing them as we go." The attackers sent 49.71 million TRX into Symbiosis in 1,367 smaller deposits, SomaXBT said.

Automated laundering, but not AI agents

Blockchain analytics firm Elliptic said Saturday that the hackers' main Tron distribution wallet paid out every hour for 31 straight hours and never paused longer than 46 minutes. The same swap amounts kept recurring in THORChain deposits, one of them 19 times. When a bridge rejected deposits, new wallets automatically re-sent the funds to the same destination.

Elliptic co-founder Tom Robinson said in comments shared with The Block that the activity does not appear to involve AI agents. "The pattern is repetitive and static: the same sizes, the same rhythm, the same routes, hour after hour," Robinson said. He added that test transactions and round-number top-ups point to "operators making decisions, with scripts doing the repetitive work." In the Bybit case, laundering followed human working patterns, according to the firm.

Stablecoin freezes fall short

Elliptic has verified $2.85 billion of the stolen funds as frozen or seized — about 44% of the $6.43 billion it counts as stolen — and 94% of that is stablecoins. No funds have been frozen on Bitcoin, the XRP Ledger, Solana or NEAR. About $3.25 billion, including 18,327 BTC and 233 million XRP, sits in assets that no issuer can freeze.

Tether's frozen USDT is split across two attacker wallets, with 312.7 million in one and 65.99 million in the other, per Tronscan data. Mempool.space data checked by The Block shows all 18,270 BTC still sitting in the 19 bitcoin addresses on the FBI's list.

Chainalysis said Saturday the hackers have been depositing stablecoins into DeFi protocols on Tron to receive deposit receipt tokens, which cannot be frozen, then redeeming them from new addresses. Chainalysis did not name the protocol, though other onchain analysts identified it as JustLend, and did not say whether it was JustLend when asked. TRM Labs said 300 million USDT moved to a Tron wallet that "began supplying it to the JustLend lending protocol." Tronscan data shows that wallet put 10,000 USDT into JustLend, swapped about 234 million USDT for TRX on decentralized exchanges and sent 65.99 million USDT to one of the two frozen wallets.

What is confirmed and what is still unclear

The FBI's attribution to TraderTraitor, the alert's address list, and the appeal to block transactions are confirmed by the agency. The laundering figures come from onchain analysts SomaXBT, Specter, Elliptic, Chainalysis, TRM Labs and Lookonchain, and are reported rather than officially verified. THORChain has not said whether it will block the listed addresses. The Block has reached out to Relay, Barraford, Chainflip and Bitget Wallet for comment, and no responses are included in the source material.

Sources

• The Block

Read also: North Korea denies role in $6.3 billion Binance hack and points finger at the US