Binance Laundering Trail Revealed: North Korea Moves $242M in Two Days, $140M Through Cross-Chain Bridge

North Korean Hackers Laundered $242 Million in Stolen Binance Funds on Tron Chain Within Two Days

North Korean hackers have successfully laundered approximately $242 million in cryptocurrency stolen from Binance onto the Tron blockchain within a two-day period. A significant portion of these illicit funds, around $140 million, was moved through four different cross-chain bridges and exchange services. In parallel, the FBI has requested THORChain node operators to block addresses associated with the laundering operation, though a co-founder stated that nodes do not possess non-public information and did not commit to compliance.

Scale of Laundering Exceeds Previous Disclosures

The scale of the laundered funds is larger than initially revealed. On-chain analyst SomaXBT reported that hackers extracted approximately $628 million from Binance, and after Tether froze $378.7 million USDT, an estimated $249 million remained available for movement. Of the $242 million laundered over two days, roughly $194 million was moved off the Tron chain via cross-chain bridges and exchange services, $26 million remains on the chain, and an additional $22 million was lost to fees, slippage, and price volatility.

Funds Routed Through Multiple Channels

The funds were dispersed across various channels. According to SomaXBT’s analysis, Relay handled $48 million, THORChain $44 million, Chainflip $32.1 million, and Symbiosis $16 million, totaling approximately $140 million. Bitget Wallet also processed $41.7 million, though the ultimate destination of these funds remains unclear.

FBI Identifies North Korean Nexus in Binance Hack

Binance suffered a loss of approximately $6.3 billion on Thursday, marking the largest theft in cryptocurrency history. On Saturday, the FBI, in conjunction with the U.S. Secret Service and the IRS Criminal Investigation division, issued a joint alert attributing the attack to North Korea’s TraderTraitor group. The alert listed 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address, but notably, no Tron addresses were included.

The FBI alert stated that the hackers were “primarily converting stolen assets into Ether” and anticipated that the funds would be laundered through DeFi protocols and instant exchange services. Consequently, the FBI urged THORChain’s THORNode operators, along with RPC nodes, instant exchange providers, and other service providers, to block transactions related to the theft. TraderTraitor has been designated by the U.S. government as a North Korean state-sponsored hacking group since 2020, and is tracked by the industry under names such as Lazarus Group, APT38, and BlueNoroff. This same group was also implicated in the $1.5 billion Bybit theft in February 2025.

THORChain Co-Founder’s Response and Network Disruptions

THORChain co-founder Chad Barraford stated on X that THORNode operators do not possess any non-public information and that “no subpoena is needed, this is the best-case scenario for an investigation.” However, his subsequent posts did not clarify whether nodes would block the listed addresses.

Adding to the complexity, THORChain itself experienced disruptions. Chainalysis explained on X that an Ethereum reorg on Saturday caused THORChain to issue duplicate refunds for a 10 ETH deposit, leading to an emergency pause of the system. This pause prevented all users, including the hackers, from conducting further exchanges through most of its bridges. As of Sunday afternoon Eastern Time, 10 out of THORChain’s 13 connected chains remained offline, with Tron transactions halted since Saturday noon.

Analysis indicates that the hackers deposited a total of 185.1 million TRX and 3.83 million USDT in 2,697 transactions into THORChain. The protocol, in turn, paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses. The hackers incurred approximately a 12% loss in fees and slippage on this route, while the front-end interface earned about 145,800 RUNE, valued at approximately $95,000. During the 2025 Bybit incident, Lazarus similarly used THORChain to convert large amounts of Ether into Bitcoin.

Relay Emerges as Key Laundering Tool

Relay played a central role in this laundering operation. SomaXBT’s statistics show it received 37.64 million USDT and 39.28 million TRX in 735 transactions. Notably, this protocol had rarely appeared in previous TraderTraitor laundering activities. On-chain analyst Specter reported that hackers bridged $38 million through Relay within seven hours. Relay has previously stated that it screens transaction addresses using third-party risk data, including Chainalysis, and internal blacklists.

Traces on Ethereum and Solana

On Ethereum, Etherscan data reveals that one address received 2,804 ETH and 1.02 million USDT in 97 transactions from Relay’s routers and solvers within approximately 80 minutes. This address then swapped the USDT for Ether on CoW Protocol before transferring approximately 3,257 ETH, valued at $7.4 million, to four new addresses not on the FBI’s list.

On Sunday, the hackers began addressing their holdings on Solana. Lookonchain reported that the hackers converted 970,522 SOL, worth approximately $95.9 million, into Bitcoin via Relay. The Solana wallet in question was the only Solana address on the FBI’s list. Within an hour before Lookonchain’s post, it had moved 486,970 SOL (approximately $46.4 million) and still held about 466,700 SOL at the time of reporting.

Chainflip and Symbiosis Respond to Laundering Attempts

Chainflip received 49.47 million USDT in 571 transactions, but many exchanges failed. These failed transactions were refunded to new Tron wallets and then resent, amounting to 17.91 million USDT. Chainflip had previously planned an upgrade to block hackers in the Bybit incident last year. Symbiosis responded on X that it had detected attempts to transfer Binance stolen funds through its platform and was in contact with Binance. “Our screening is designed for normal traffic, and for funds that move quickly and with complex methods, some mechanisms do have gaps, which we will gradually fill,” the company stated. Hackers deposited a total of 49.71 million TRX in 1,367 small transactions into Symbiosis. The protocol had previously recovered 15 BTC after its own Bitcoin bridge was attacked in September.

Predictable Laundering Patterns Observed

Elliptic observed an unusually regular rhythm in this round of laundering. The main wallet made hourly payments for 31 consecutive hours, with the longest pause not exceeding 46 minutes. Identical amounts were repeatedly deposited into THORChain, with one deposit occurring 19 times. When a bridge rejected a deposit, new wallets would automatically resend the funds to the same destination.

Elliptic co-founder Tom Robinson stated that these activities did not appear to involve AI agents. “The patterns are repetitive and static: the same amounts, the same rhythm, the same paths, hour after hour,” he said, adding that test transactions and integer amount top-ups pointed to “human decision-making, with scripts doing the repetitive work.” In contrast, the laundering pace of the 2025 Bybit case was more aligned with human activity.

Frozen Assets and Unrecoverable Funds

Elliptic has confirmed approximately $2.85 billion in assets frozen or seized, representing about 44% of the $6.43 billion in stolen funds it tracked, with 94% being stablecoins. No funds have been frozen on Bitcoin, XRP Ledger, Solana, or NEAR. An additional approximately $3.25 billion remains in assets that cannot be frozen by any issuer, including 18,327 BTC and 233 million XRP. The USDT frozen by Tether is distributed across two attacker wallets, valued at $312.7 million and $65.99 million, respectively. The 19 Bitcoin addresses on the FBI’s list, holding 18,270 BTC, remain untouched. (Binance officially estimates losses at approximately $6.3 billion, while Elliptic’s tracking methodology accounts for $6.43 billion.)

Stablecoins Converted to Unfreezable Wrapped Assets

Funds other than stablecoins were converted into “unfreezable” wrapped assets. Chainalysis pointed out on X that hackers deposited stablecoins into DeFi protocols on Tron to obtain deposit receipt tokens, which cannot be frozen, and later redeemed them from new addresses. Chainalysis did not name the specific protocol, but other on-chain analysts believe it to be JustLend. TRM Labs reported that $300 million USDT flowed into a Tron wallet, which then began supplying funds to JustLend. Tronscan data shows it deposited 10,000 USDT into JustLend, swapped approximately $234 million USDT for TRX on a decentralized exchange, and sent $65.99 million USDT to one of the frozen wallets.

Law Enforcement Pressure on Cross-Chain Protocols

The significance of this incident lies in the unprecedented direct pressure of law enforcement on cross-chain protocols. In the past year, stablecoin issuers and centralized exchanges have been the most reliable nodes for law enforcement. Tether’s one-click freeze of $378.7 million USDT was the direct cause of the slowdown in this laundering operation. However, when funds move to permissionless cross-chain bridges, the FBI can only “urge” node operators to cooperate, and THORChain’s response demonstrates the lack of enforcement power in this avenue.

This explains why the laundering routes are nearly identical to those used a year ago. In the 2025 Bybit case, Lazarus also converted large amounts of Ether into Bitcoin via THORChain, with limited recovery efforts afterward. A year later, the same group used Relay as the primary conduit, with THORChain as a secondary option, repeating the same tactics. Among the four named protocols, only Symbiosis publicly admitted to gaps in its screening mechanisms. For asset holders, this implies that freezes can only secure stablecoin portions, and the $3.25 billion in Bitcoin and XRP are almost certainly unrecoverable. The “freezable ratio” of on-chain assets will become a new metric for evaluating the risk of exchanges and cross-chain bridges.

Key Observations for Future Developments

Three key points warrant observation moving forward. First, whether THORChain nodes will indeed join the blocklist. If they do, it would signify a tilt by permissionless protocols towards law enforcement, directly testing the RUNE community’s consensus on its “censorship-resistant” positioning. Second, the destination of the $41.7 million handled by Bitget Wallet remains unconfirmed, a lead that could be more valuable than the bridge information. Third, while the FBI’s list contains no Tron addresses, the largest portion of stolen funds remains on Tron. Whether deposit receipt paths like JustLend will become the next focus of freezes and regulation is worth continued tracking.