North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst

North Korean hackers have laundered about $242 million of the funds stolen from Binance on the Tron blockchain in two days, onchain analyst and Security Alliance (SEAL) contributor SomaXBT said on X on Sunday, as the FBI presses THORChain and other services to block the transactions.

The attackers took about $628 million from Binance on Tron and had roughly $249 million left to move after Tether froze 378.7 million USDT, SomaXBT said in his thread. Most of the $242 million, about $194 million, left Tron through bridges and swap services. Another $26 million stayed on the network, while about $22 million went to fees, slippage and price moves, according to the analyst.

The funds moved through a variety of crypto bridges: Relay handled $48 million of the outflows, THORChain $44 million, Chainflip $32.1 million and Symbiosis $16 million, together about $140 million, SomaXBT said. Bitget Wallet handled another $41.7 million, but where that money ended up is still unresolved, the analyst said.

Binance lost about $6.3 billion on Thursday in the largest crypto hack on record. The FBI attributed the theft to the TraderTraitor group on Saturday in an alert issued with the U.S. Secret Service and IRS Criminal Investigation.

The FBI said the hackers were converting stolen assets "primarily into Ethereum" and expects the funds to be further laundered through DeFi protocols and instant swap services. It urged THORChain's THORNode operators, alongside RPC node operators, instant exchanges, DeFi services and other providers, to block transactions tied to the theft. The agency also published a list of 608 Ethereum addresses, 19 bitcoin addresses and one Solana address, but no Tron addresses, that it said were linked to the attack.

A 2022 joint advisory from the FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department describes TraderTraitor as a North Korean state-sponsored hacking group, active since at least 2020, that steals and launders crypto "to support the North Korean regime." The advisory says the cybersecurity industry tracks the group under various designations, including Lazarus Group, APT38 and BlueNoroff.

The FBI also blamed TraderTraitor for the $1.5 billion Bybit hack in February 2025. The agency's recent alert did not disclose the evidence that led it to its attribution, though blockchain analysis firms Chainalysis, Elliptic and TRM Labs had already linked the theft to North Korea through onchain ties to earlier North Korean hacks.

THORChain co-founder doesn't commit to blocking hackers

THORChain technical co-founder Chad Barraford wrote on X on Saturday evening that "THORNode operators have zero information that isn't already public and readily available in real time." He added, "No subpoenas required, a best case scenario for investigations," but his posts since the hack have not said whether node operators would block the listed addresses.

Earlier on Saturday, an Ethereum reorg caused THORChain to double-refund a 10 ETH deposit, which triggered an emergency pause, Chainalysis said. The pause, somewhat ironically, stopped all users, including the hackers, from swapping through most of THORChain's bridges, according to the firm.

THORChain trading remained halted on 10 of its 13 connected chains, including Tron, Ethereum and Bitcoin, as of 1:20 p.m. ET Sunday, according to THORChain node data. Trading from Tron has been halted since around midday Saturday.

The attackers have sent 185.1 million TRX and 3.83 million USDT into THORChain in 2,697 deposits, SomaXBT said. THORChain has paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses.

The attackers lost about 12% to fees and slippage, and front-end interfaces earned about 145,800 RUNE, roughly $95,000, in affiliate fees. North Korea's Lazarus Group also used THORChain to move much of the ether stolen from Bybit's $1.5 billion hack onto bitcoin in February 2025.

Relay, Chainflip and Symbiosis also move funds

Relay received 37.64 million USDT and 39.28 million TRX in 735 deposits, SomaXBT said, adding that the protocol "barely featured" in laundering from past TraderTraitor hacks. Onchain analyst Specter said on Saturday that the hackers bridged $38 million through Relay in seven hours, despite Relay's statement that it screens transaction addresses using third-party risk data, including from Chainalysis, and an internal blocklist.

One Ethereum address received 2,804 ETH and 1.02 million USDT from Relay's router and solvers in 97 payments over about 80 minutes on Saturday, Etherscan data shows, matching SomaXBT's figures. The wallet swapped the USDT for ether on CoW Protocol and sent about 3,257 ETH, roughly $7.4 million, to four new addresses. None of the five addresses is on the FBI's list.

On Sunday, the hackers separately began swapping 970,522 SOL, worth about $95.9 million, for bitcoin through Relay, Lookonchain reported.  The hackers' Solana wallet, the only Solana address on the FBI's list, moved 486,970 SOL ($46.4 million) in the hour before Lookonchain's 5:35 a.m. ET post. The Relay-powered swaps began after the FBI listed the wallet on Saturday. The wallet held about 466,700 SOL at publication time, the same balance as at 9:55 a.m. ET, per Solscan data.

Chainflip received 49.47 million USDT in 571 deposits, but many swaps failed, SomaXBT said. Failed swaps were refunded to fresh Tron wallets and sent back in, 17.91 million USDT in all. Chainflip planned an upgrade last year to block the Bybit hackers from its cross-chain DEX.

Symbiosis said early Sunday it had identified attempts to move Binance hack funds through its protocol and was in contact with Binance. "Our screening is built for normal flows, not for tracking fast-moving, sophisticated attempts so some mechanisms have gaps," Symbiosis said on X. "We're closing them as we go."

The attackers sent 49.71 million TRX into Symbiosis in 1,367 smaller deposits, SomaXBT said. Symbiosis recovered 15 BTC after an exploit of its own bitcoin bridge in September.

Automated laundering, but not AI agents?

The hackers' main Tron distribution wallet paid out every hour for 31 straight hours and never paused for longer than 46 minutes, blockchain analytics firm Elliptic said on Saturday. The same swap amounts kept recurring in THORChain deposits, one of them 19 times.

When a bridge rejected deposits, new wallets automatically re-sent the funds to the same destination, Elliptic said. In the Bybit case, laundering followed human working patterns, according to the firm.

Elliptic co-founder Tom Robinson said in comments shared with The Block that the activity does not appear to involve AI agents. "The pattern is repetitive and static: the same sizes, the same rhythm, the same routes, hour after hour," Robinson said. He added that test transactions and round-number top-ups point to "operators making decisions, with scripts doing the repetitive work."

Hackers evade some stablecoin freezes

Elliptic has verified $2.85 billion of the stolen funds as frozen or seized, about 44% of the $6.43 billion it counts as stolen, and 94% of that is stablecoins. No funds have been frozen on Bitcoin, the XRP Ledger, Solana or NEAR. About $3.25 billion, including 18,327 BTC and 233 million XRP, is held in assets that no issuer can freeze, the firm said.

Tether's frozen USDT is split across two attacker wallets, with 312.7 million in one and 65.99 million in the other, per Tronscan data. Mempool.space data checked by The Block shows all 18,270 BTC still sitting in the 19 bitcoin addresses on the FBI's list.

Chainalysis said on Saturday the hackers have been depositing stablecoins into DeFi protocols on Tron for depository receipt tokens, which cannot be frozen, and later redeeming them from new addresses. It did not name the protocol, which other onchain analysts identified as JustLend, and did not address a question from The Block about whether it was JustLend.

TRM Labs said 300 million USDT moved to a Tron wallet that "began supplying it to the JustLend lending protocol." Tronscan data shows that wallet put 10,000 USDT into JustLend, swapped about 234 million USDT for TRX on decentralized exchanges and sent 65.99 million USDT to one of the two frozen wallets.

The Block has reached out to Relay, Barraford, Chainflip, and Bitget Wallet for comment.