North Korean Hackers Move $242 Million in Binance Stolen Funds Through Tron as FBI Urges THORChain to Block Transactions

North Korean hackers laundered approximately $242 million of the funds stolen from Binance through the Tron blockchain over a two-day period, according to onchain analyst and Security Alliance (SEAL) contributor SomaXBT, who reported the activity on X on Sunday. The movement came as the FBI pressed THORChain and other service providers to block transactions connected to the theft.

The attackers initially took approximately $628 million from Binance on Tron. After Tether froze 378.7 million USDT, they had about $249 million remaining to move, SomaXBT said in a thread. Of the $242 million moved, approximately $194 million left Tron through bridges and swap services. Another $26 million remained on the network, while roughly $22 million was absorbed by fees, slippage and price movements, according to the analyst.

The funds passed through several crypto bridges. Relay processed $48 million of the outflows, THORChain handled $44 million, Chainflip processed $32.1 million and Symbiosis handled $16 million, bringing the combined total to about $140 million, SomaXBT said. Bitget Wallet processed a further $41.7 million, although the analyst said it remains unclear where those funds ultimately went.

Binance suffered a loss of approximately $6.3 billion on Thursday in what was the largest cryptocurrency hack on record. On Saturday, the FBI attributed the theft to the TraderTraitor group in an alert issued jointly with the U.S. Secret Service and IRS Criminal Investigation.

The FBI said the hackers were converting the stolen assets “primarily into Ethereum” and anticipated that the funds would undergo further laundering through DeFi protocols and instant-swap services. The agency called on THORChain THORNode operators, as well as RPC node operators, instant exchanges, DeFi services and other providers, to block transactions associated with the theft. It also released a list of 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that it said were connected to the attack. The list did not include any Tron addresses.

A 2022 joint advisory issued by the FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department describes TraderTraitor as a North Korean state-sponsored hacking group that has been active since at least 2020 and steals and launders cryptocurrency “to support the North Korean regime.” The advisory says cybersecurity firms and researchers track the group under several names, including Lazarus Group, APT38 and BlueNoroff.

The FBI also held TraderTraitor responsible for the $1.5 billion Bybit hack in February 2025. The agency’s latest alert did not disclose the evidence behind its attribution. However, blockchain analytics companies Chainalysis, Elliptic and TRM Labs had already connected the Binance theft to North Korea based on onchain links with earlier hacks attributed to North Korean actors.

THORChain co-founder does not commit to blocking hackers

On Saturday evening, THORChain technical co-founder Chad Barraford wrote on X that “THORNode operators have zero information that isn't already public and readily available in real time.” He added: “No subpoenas required, a best case scenario for investigations.” However, his posts since the hack have not clarified whether node operators would block the addresses identified in the FBI alert.

Earlier on Saturday, an Ethereum reorganization caused THORChain to issue a double refund for a 10 ETH deposit, prompting an emergency pause, Chainalysis said. In an ironic turn, the pause prevented all users, including the hackers, from swapping assets through most of THORChain’s bridges, according to the analytics firm.

As of 1:20 p.m. ET on Sunday, trading on THORChain remained halted on 10 of its 13 connected chains, including Tron, Ethereum and Bitcoin, according to data from THORChain nodes. Trading involving Tron had been suspended since around midday Saturday.

The attackers deposited 185.1 million TRX and 3.83 million USDT into THORChain through 2,697 transactions, SomaXBT said. THORChain, in turn, paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses.

The attackers incurred losses of approximately 12% through fees and slippage. Front-end interfaces earned about 145,800 RUNE, worth roughly $95,000, in affiliate fees. North Korea’s Lazarus Group had also used THORChain in February 2025 to convert much of the ether stolen in the $1.5 billion Bybit hack into bitcoin.

Relay, Chainflip and Symbiosis also process stolen funds

Relay received 37.64 million USDT and 39.28 million TRX across 735 deposits, SomaXBT said, adding that the protocol had “barely featured” in laundering activity linked to previous TraderTraitor hacks. On Saturday, onchain analyst Specter said the hackers had bridged $38 million through Relay in seven hours. This occurred despite Relay’s statement that it screens transaction addresses using third-party risk data, including information from Chainalysis, as well as an internal blocklist.

Data from Etherscan shows that one Ethereum address received 2,804 ETH and 1.02 million USDT from Relay’s router and solvers in 97 payments over approximately 80 minutes on Saturday, consistent with SomaXBT’s figures. The wallet exchanged the USDT for ether on CoW Protocol and then transferred about 3,257 ETH, worth approximately $7.4 million, to four newly created addresses. None of those four addresses, nor the original receiving address, appears on the FBI’s list.

On Sunday, the hackers separately began exchanging 970,522 SOL, valued at approximately $95.9 million, for bitcoin through Relay, Lookonchain reported. During the hour before Lookonchain’s post at 5:35 a.m. ET, the hackers’ Solana wallet—the only Solana address included on the FBI’s list—transferred 486,970 SOL, worth $46.4 million. The Relay-powered swaps began after the FBI added the wallet to its list on Saturday. According to Solscan data, the wallet held approximately 466,700 SOL at the time of publication, the same balance recorded at 9:55 a.m. ET.

Chainflip received 49.47 million USDT through 571 deposits, but many of the swaps failed, SomaXBT said. The failed transactions were refunded to newly created Tron wallets, which then sent the funds back into the service. The total amount involved in these repeated transfers was 17.91 million USDT. Chainflip had planned an upgrade the previous year intended to prevent the Bybit hackers from using its cross-chain decentralized exchange.

Symbiosis said early Sunday that it had detected attempts to move funds from the Binance hack through its protocol and was communicating with Binance. “Our screening is built for normal flows, not for tracking fast-moving, sophisticated attempts so some mechanisms have gaps,” Symbiosis wrote on X. “We're closing them as we go.”

According to SomaXBT, the attackers sent 49.71 million TRX into Symbiosis through 1,367 smaller deposits. Symbiosis recovered 15 BTC following an exploit involving its own bitcoin bridge in September.

Automated laundering, but not necessarily AI agents

The hackers’ main Tron distribution wallet made payouts every hour for 31 consecutive hours and never went more than 46 minutes without a payment, blockchain analytics firm Elliptic said on Saturday. Identical swap amounts repeatedly appeared in THORChain deposits, with one amount recurring 19 times.

Elliptic said that when a bridge rejected deposits, newly created wallets automatically sent the funds again to the same destination. In the Bybit case, the laundering activity followed patterns associated with human work, the firm said.

Elliptic co-founder Tom Robinson told The Block that the activity did not appear to involve AI agents. “The pattern is repetitive and static: the same sizes, the same rhythm, the same routes, hour after hour,” Robinson said. He added that test transactions and top-ups in round-number amounts suggest “operators making decisions, with scripts doing the repetitive work.”

Hackers bypass some stablecoin freezes

Elliptic has verified that $2.85 billion of the stolen funds has been frozen or seized. That represents approximately 44% of the $6.43 billion the firm counts as stolen, and stablecoins account for 94% of the frozen or seized amount. No funds have been frozen on Bitcoin, the XRP Ledger, Solana or NEAR. Approximately $3.25 billion, including 18,327 BTC and 233 million XRP, remains in assets that cannot be frozen by an issuer, the firm said.

According to Tronscan data, the USDT frozen by Tether is divided between two attacker wallets: 312.7 million USDT in one and 65.99 million USDT in the other. Data from Mempool.space reviewed by The Block shows that all 18,270 BTC remain in the 19 Bitcoin addresses included on the FBI’s list.

Chainalysis said on Saturday that the hackers had been depositing stablecoins into DeFi protocols on Tron in exchange for deposit-receipt tokens that cannot be frozen, then redeeming those tokens from new addresses. The company did not identify the protocol. Other onchain analysts identified it as JustLend, but Chainalysis did not respond to The Block’s question about whether JustLend was the protocol involved.

TRM Labs said that 300 million USDT had moved to a Tron wallet that “began supplying it to the JustLend lending protocol.” Tronscan data shows that the wallet deposited 10,000 USDT into JustLend, exchanged approximately 234 million USDT for TRX on decentralized exchanges, and transferred 65.99 million USDT to one of the two wallets whose funds had been frozen.

The Block has contacted Relay, Barraford, Chainflip and Bitget Wallet for comment.