Binance hack laundering: North Korean hackers move $242M off Tron as FBI presses THORChain

1 Nov 2026

1 Nov 2026, 20:05 UTC+01:00

Exchanges TradeReviewed News Desk

Binance hack laundering is accelerating on Tron. North Korean hackers have moved about $242 million of the funds stolen from Binance on the Tron blockchain in two days, onchain analyst and Security Alliance (SEAL) contributor SomaXBT said on Sunday, Nov. 1, as reported by The Block. Chainalysis separately said the Tron operation spanned more than 1,000 addresses and over 3,000 deposits before funds dispersed across chains, including Solana, according to The Defiant.

Where the Tron funds went

The attackers took about $628 million from Binance on Tron and had roughly $249 million left to move after Tether froze 378.7 million USDT, SomaXBT said. About $194 million left Tron through bridges and swap services, $26 million stayed on the network and about $22 million was lost to fees, slippage and price moves.

• Relay: about $48 million
• THORChain: about $44 million
• Chainflip: about $32.1 million
• Symbiosis: about $16 million

Another $41.7 million went through Bitget Wallet, but its final destination is still unresolved, the analyst said. On Sunday the hackers also began swapping 970,522 SOL for bitcoin through Relay, a move we covered in our report on the SOL to BTC swaps.

FBI pressure on THORChain

The FBI, which attributed the $6.3 billion theft to North Korea’s TraderTraitor group (our coverage), urged THORChain node operators, RPC providers, instant exchanges and DeFi services to block transactions tied to the hack. It published 608 Ethereum addresses, 19 bitcoin addresses and one Solana address, but no Tron addresses. THORChain technical co-founder Chad Barraford said node operators have no non-public information, but did not say whether they would block the listed addresses.

THORChain trading was halted on 10 of its 13 connected chains, including Tron, Ethereum and Bitcoin, as of 1:20 p.m. ET Sunday, after an Ethereum reorg triggered an emergency pause on Saturday. Symbiosis said its screening “has gaps” for fast-moving flows and that it is closing them.

Freezes cover less than half

Elliptic has verified $2.85 billion of stolen funds as frozen or seized, about 44% of the $6.43 billion it counts as stolen, and 94% of that is stablecoins. About $3.25 billion, including 18,327 BTC and 233 million XRP, sits in assets no issuer can freeze. Elliptic said the laundering looks scripted rather than AI-driven, with the same sizes and routes repeating hour after hour.

What it means for traders

Large stolen balances in BTC, ETH, SOL and XRP remain a potential source of selling pressure if they are swapped or cashed out. Spreading funds across platforms with published proof of reserves reduces single-exchange risk. Our exchange comparison covers security and fees, including our top picks BingX and OKX.

This is not financial advice.

Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.

Related reviews

• Bingx review
• Okx review

Sources

• The Block: North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst
• The Defiant: Binance-Hack Launderers Reach Solana After Draining $500 Million on Tron, Chainalysis Says

News is for information only and is not financial advice. More crypto news