North Korean hackers laundered about $242 million stolen from Binance via Tron in two days, mainly through Relay and THORChain, despite pressure from the FBI.

According to SomaXBT, an on-chain data analyst and contributor to the Security Alliance (SEAL), North Korean hackers laundered about $242 million stolen from Binance on the Tron blockchain in just two days. The attackers stole about $628 million from Binance on Tron, and after Tether froze 378.7 million USDT, about $249 million remained to be laundered. Of the $242 million processed, about $194 million left Tron through bridges and swap services, $26 million remained on the network, and about $22 million was lost to fees, slippage, and price fluctuations.

Outflows were spread across several channels: Relay handled $48 million, THORChain $44 million, Chainflip $32.1 million, and Symbiosis $16 million, for a total of approximately $140 million. Bitget Wallet handled an additional $41.7 million, but the ultimate destination has not been identified.

This development comes as the FBI, in coordination with the U.S. Secret Service and the IRS Criminal Investigation division (IRS-CI), formally attributed the theft of approximately $6.4 billion to the TraderTraitor group, also known as the Lazarus Group, APT38, or BlueNoroff. The FBI published a list of 608 Ethereum addresses, 19 bitcoin addresses, and one Solana address linked to the group, but no Tron addresses, while urging THORNode operators, RPC nodes, instant-swap exchanges, and DeFi services to block related transactions.

Cross-chain bridges under pressure

THORChain co-founder and technical lead Chad Barraford said node operators hold no information beyond publicly available data, but did not say whether the addresses named by the FBI had been blocked. Ironically, an Ethereum chain reorganization caused THORChain to refund a 10 ETH deposit twice, triggering an emergency pause that inadvertently prevented the hackers from using most bridges as well. By Sunday afternoon, transactions were still halted on 10 of the 13 connected chains. Earlier, the attackers had moved 185.1 million TRX and 3.83 million USDT into THORChain through 2,697 deposits.

Relay, a protocol largely absent from TraderTraitor’s previous money-laundering operations, emerged as the biggest channel this time, despite claiming to screen addresses using risk data from Chainalysis. According to Lookonchain, the hackers also began swapping 970,522 SOL, worth approximately $95.9 million, for bitcoin through Relay after the FBI listed their Solana wallets. Symbiosis acknowledged that its screening system was not designed to track sophisticated, rapidly moving funds.

Elliptic said the main distribution wallet on Tron made regular payouts every hour for 31 consecutive hours, unlike the 2025 Bybit incident, which took place during working hours. Co-founder Tom Robinson said this was a human-directed automated-script pattern, not an AI agent.

According to Elliptic, approximately $2.85 billion, or 44% of the stolen funds, has been frozen or seized, 94% of it in stablecoins. However, around $3.25 billion, including 18,327 BTC and 233 million XRP, is held in assets that cannot be frozen. The hackers also circumvented the freeze by depositing stablecoins into a lending protocol on Tron, identified as JustLend, receiving deposit receipt tokens and then redeeming them from a new address.