Crypto
North Korean Hackers Push Binance Loot Through Cross-Chain Swaps as THORChain Pause Slows Laundering
Image: Shutter_Speed via Pixabay
About $242 million moved through Tron in two days, while investigators have frozen roughly 44% of the record theft.
By Noris Ortiz ·
Hackers linked to North Korea moved hundreds of millions of dollars of assets stolen from Binance through cross-chain swap services over the weekend, even as a technical glitch forced one of the main routes, THORChain, to halt most of its trading on Sunday [1]. The laundering effort is the next phase of the record theft from the exchange, which Binance has said affected about $6.3 billion in customer assets [1].
According to on-chain analyst SomaXBT, a contributor to the security group SEAL, the attackers laundered about $242 million of the stolen funds on the Tron network over two days, The Block reported on Sunday [1]. The hackers took about $628 million from Binance on Tron, but stablecoin issuer Tether froze 378.7 million USDT, leaving roughly $249 million that could still be moved [1]. Of that, about $194 million left Tron through bridges and swap services, with the largest amounts routed through Relay at about $48 million, THORChain at about $44 million, Chainflip at about $32 million and Symbiosis at about $16 million [1].
The flow slowed on Sunday after an Ethereum block reorganization caused THORChain to refund a 10 ETH deposit twice, triggering an emergency pause, The Block reported, citing blockchain analytics firm Chainalysis [1]. As of 1:20 p.m. ET Sunday, trading was halted on 10 of the 13 blockchains THORChain connects, and Tron trading had been stopped since midday Saturday [1]. Before the pause, THORChain paid out 17,019 ETH and 53.25 BTC in exchange for TRX and USDT sent by the attackers, according to the report [1].
The movement follows Saturday's statement from the FBI, the U.S. Secret Service and IRS Criminal Investigation that attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group that is part of the Lazarus Group [2]. The agencies urged private-sector firms, including operators of THORChain's network nodes, to block transactions tied to the laundering, and published more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address [2]. Chainalysis chief executive Jonathan Levin said he expects the attackers to use "tens of thousands" of addresses in the coming weeks [2]. THORChain co-founder Chad Barraford said node operators have no information that is not already public, and did not say whether they would block the listed addresses [1].
Other routes remain open. Lookonchain reported on Sunday that about 970,522 SOL, worth roughly $95.9 million, was being swapped for bitcoin through Relay from the one Solana wallet on the FBI list [1]. Symbiosis said it was in contact with Binance and acknowledged its screening "has gaps" for fast-moving attempts [1].
Blockchain analytics firm Elliptic puts the total stolen at $6.43 billion and said it has verified $2.85 billion, or 44% of the theft, as frozen or seized, almost all of it in the stablecoins USDT and USDC [3]. The rest is harder to stop. Elliptic estimates the attacker controls about $3.21 billion in assets that cannot be frozen by an issuer, including 519,104 ETH and 18,270 BTC [3]. The firm said the main Tron laundering wallet made 546 transfers in about 40 hours with a median gap of 96 seconds between them [3].
For crypto markets, the pace of laundering matters because large volumes of stolen bitcoin and ether can be sold into thin markets as hackers convert them. Binance has said it replaced most of the stolen crypto [2], and it began reopening withdrawals on Sunday [3]. The next things to watch are whether THORChain node operators resume trading and act on the FBI's request, how much of the bitcoin stash begins to move, and whether more of the stolen stablecoins and tokens are frozen as investigators trace the funds.
Sources:
[1] The Block, "North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst", November 1, 2026. https://theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257
[2] CoinDesk, "FBI confirms North Korea's role in $6 billion Binance hack, asks DeFi community to block BTC, ETH, SOL addresses", October 31, 2026. https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses
[3] Elliptic, "The largest theft in history: North Korea behind the $6.4 billion Binance hack", October 30, 2026. https://www.elliptic.co/insights/binance-largest-hack-in-history/
This article was produced with AI assistance. It is for informational purposes only and is not financial advice. StockVolt and its authors may hold positions in securities mentioned.