North Korean hackers convert $242 million of Binance loot through Tron as FBI urges THORChain action

Over a span of two days, North Korean threat actors successfully washed approximately $242 million originating from the Binance theft across the Tron network, according to details shared on X on Sunday by onchain sleuth and Security Alliance contributor SomaXBT, while the FBI pressures THORChain and related platforms to block these asset movements.

As SomaXBT noted in his thread, the culprits drained roughly $628 million in total from Binance on Tron and held about $249 million remaining to transfer after Tether blacklisted 387.7 million USDT. Out of that $242 million, roughly $194 million exited Tron via swapping platforms and cross-chain bridges, the investigator reported, with an additional $26 million remaining on the blockchain, and nearly $22 million consumed by transaction fees, price fluctuations, and slippage.

The stolen capital traveled across several cryptographic bridges: Relay processed $48 million worth of the outflows, THORChain handled $44 million, Chainflip accounted for $32.1 million, and Symbiosis managed $16 million, totaling nearly $140 million altogether, explained SomaXBT. Bitget Wallet received another $41.7 million, though the final destination of those assets remains undetermined, the analyst added.

On Thursday, Binance suffered a loss of approximately $6.3 billion, marking the largest cryptocurrency exploit in history. On Saturday, the FBI publicly linked the heist to the TraderTraitor collective via a joint announcement issued alongside the United States Secret Service and the Internal Revenue Service Criminal Investigation division.

The FBI stated that the perpetrators are exchanging the stolen funds primarily into Ether and anticipates further laundering efforts through instant exchange services and decentralized finance platforms. The bureau called on THORChain node operators, alongside RPC providers, decentralized services, instant exchanges, and other entities to restrict transactions connected to the breach. Furthermore, the agency published a roster containing 608 Ethereum wallets, 19 Bitcoin wallets, and a single Solana wallet tied to the intrusion, omitting any Tron addresses.

A collaborative advisory released in 2022 by the Cybersecurity and Infrastructure Security Agency, the FBI, and the Treasury Department characterizes TraderTraitor as a state-sponsored hacking unit originating from North Korea that has operated since at least 2020, stealing and washing digital assets to finance the North Korean government. The document notes that security professionals monitor this collective under alternate names including Lazarus Group, BlueNoroff, and APT38.

The FBI also pointed to TraderTraitor as the entity behind the $1.5 billion Bybit exploit in February 2025. Although the bureau’s recent advisory did not outline the specific intelligence supporting its attribution, blockchain intelligence firms such as Elliptic, Chainalysis, and TRM Labs had already connected the breach to North Korea based on onchain correlations pointing to prior North Korean operations.

THORChain co-founder declines to promise hacker blacklisting

Chad Barraford, the technical co-founder of THORChain, posted on X late Saturday that node runners possess zero non-public data that isn’t already accessible in real time. He observed that no subpoenas are necessary, representing an optimal scenario for investigations, though his statements following the breach omitted any confirmation on whether node operators would restrict the identified addresses.

Earlier on Saturday, Chainalysis reported that an Ethereum reorg forced THORChain to execute a double-refund on a 10 ETH transfer, prompting an urgent operational suspension. Ironically, according to the firm, this freeze prevented all participants, including the threat actors, from executing swaps across the majority of THORChain bridges.

Per THORChain validator telemetry, trading activity remained suspended across 10 of its 13 integrated networks—including Bitcoin, Ethereum, and Tron—as of Sunday afternoon at 1:20 p.m. ET. Tron-based trading has stayed paused since roughly midday Saturday.

SomaXBT noted that the attackers injected 185.1 million TRX and 3.83 million USDT into THORChain across 2,697 distinct transactions. In return, THORChain disbursed 17,019 ETH to 170 unique wallets and 53.25 BTC to 20 separate addresses.

The perpetrators incurred about 12% in losses due to slippage and fees, while interface front ends collected approximately 145,800 RUNE in affiliate commissions, equal to about $95,000. Previously, the Lazarus Group from North Korea utilized THORChain to shift a significant portion of the Ether taken during the $1.5 billion Bybit breach into Bitcoin back in February 2025.

Relay, Chainflip, and Symbiosis also channel funds

Relay gathered 37.64 million USDT and 39.28 million TRX across 735 transfers, SomaXBT reported, highlighting that the platform rarely featured in laundering operations tied to previous TraderTraitor incidents. On Saturday, blockchain analyst Specter pointed out that the hackers successfully bridged $38 million via Relay within a seven-hour window, despite Relay’s official documentation stating that transaction destinations undergo compliance screening through internal blocklists and third-party risk intelligence providers like Chainalysis.

Data from Etherscan confirms that a single Ethereum wallet collected 2,804 ETH and 1.02 million USDT from routers and solvers managed by Relay across 97 distinct transactions in roughly 80 minutes on Saturday, mirroring SomaXBT’s metrics. This wallet converted the USDT for Ether through CoW Protocol and transmitted approximately 3,257 ETH, valued at about $7.4 million, to four brand-new addresses. None of these five wallets appear on the FBI’s registry.

According to Lookonchain, the hackers independently began trading 970,522 SOL—valued at roughly $95.9 million—for Bitcoin via Relay on Sunday. The primary Solana wallet controlled by the thieves, which is the sole Solana address on the FBI’s roster, transferred 486,970 SOL amounting to $46.4 million during the hour leading up to Lookonchain’s post at 5:35 a.m. ET. The Relay-facilitated exchanges commenced subsequent to the FBI publishing the wallet address on Saturday. Solscan records indicate that the account maintained roughly 466,700 SOL when published, matching its balance at 9:55 a.m. ET.

Chainflip took in 49.47 million USDT via 571 deposits, though multiple transactions failed, according to SomaXBT. The platform refunded unsuccessful trades back to new Tron wallets, totaling 17.91 million USDT sent back in. Last year, Chainflip outlined preparations for a software update designed to block the Bybit breach operators from accessing its cross-chain decentralized exchange.

Symbiosis announced early Sunday that it detected attempts to route stolen Binance capital through its system and established communication with Binance. The protocol stated on X that its filtering mechanisms are designed for standard user volumes rather than rapid, sophisticated laundering techniques, leaving certain gaps that they are actively closing.

SomaXBT noted that the culprits routed 49.71 million TRX into Symbiosis via 1,367 micro-deposits. Back in September, Symbiosis successfully reclaimed 15 BTC following a separate security breach affecting its own Bitcoin bridge.

Automated fund transfers, but lacking AI agents

Blockchain security firm Elliptic reported Saturday that the primary Tron distribution wallet belonging to the attackers executed transactions every hour for 31 consecutive hours, pausing for no longer than 46 minutes at a time. Identical transfer amounts repeatedly appeared inside THORChain inflows, with one specific figure repeating 19 times.

When bridges rejected transactions, fresh wallets automatically re-routed the capital toward the identical destination, Elliptic observed. In contrast, the financial mixing observed during the Bybit incident aligned with standard human working hours.

Tom Robinson, co-founder of Elliptic, noted in feedback provided to The Block that the behavior does not appear indicative of autonomous AI agents. The procedural rhythm remains fixed and repetitive, involving identical routes, intervals, and amounts hour after hour, Robinson explained, suggesting that human operators make strategic choices while automated scripts execute repetitive actions.

Hackers bypass select stablecoin blacklists

Elliptic has confirmed the seizure or freezing of $2.85 billion in stolen assets—representing roughly 44% of the $6.43 billion it tracks as missing—with 94% of that amount consisting of stablecoins. Zero assets have been frozen across Bitcoin, Solana, the XRP Ledger, or NEAR. Approximately $3.25 billion, encompassing 233 million XRP and 18,327 BTC, sits within currencies that lack any centralized issuing authority capable of enforcing a freeze, the firm stated.

Tronscan telemetry indicates that Tether’s frozen tokens reside across two hacker-controlled wallets, holding 312.7 million and 65.99 million respectively. Analysis of Mempool.space by The Block verifies that all 18,270 BTC remain untouched within the 19 Bitcoin wallets published by the FBI.

Chainalysis stated on Saturday that the threat actors have deposited stablecoins into decentralized finance platforms on Tron to acquire unfreezable depository receipt tokens, which they subsequently redeem via newly created accounts. Although the firm omitted the name of the protocol, other onchain researchers identified it as JustLend, and Chainalysis did not respond to inquiries from The Block concerning that identification.

TRM Labs reported that 300 million USDT migrated to a Tron wallet that subsequently supplied the capital to the JustLend lending platform. Tronscan data confirms that this wallet deposited 10,000 USDT into JustLend, exchanged about 234 million USDT for TRX on automated market makers, and forwarded 65.99 million USDT to one of the two blacklisted accounts.

The Block reached out to Barraford, Relay, Chainflip, and Bitget Wallet for statements.