A reported theft of roughly $6.3 billion from 17 Binance hot wallets on Oct. 29 has put renewed attention on how quickly North Korea-linked crypto laundering networks can shift funds beyond the reach of token issuers, bridges and centralized platforms.
The attackers, identified in the supplied account as Lazarus Group, allegedly moved assets through nine blockchains, including Ethereum, Bitcoin, Tron and Solana. The group has long been linked by U.S. authorities to North Korea's Reconnaissance General Bureau, with the U.S. government saying stolen cryptocurrency can generate foreign currency for a country constrained by international sanctions and connected to weapons programs.
The reported scale would make the incident one of the largest thefts in cryptocurrency history. The early transaction pattern also fits a familiar problem for the industry: emergency freezes can stop part of a theft, but automated cross-chain activity can move the remaining funds through decentralized infrastructure before coordinated action takes effect.
Issuer freezes reportedly contained billions
Bitquery data cited in the report showed that about $2.7 billion of the stolen assets was frozen or otherwise placed under the control of issuers and related entities. The same data indicated that about $729 million in USDT moved before freezes were applied.
The attackers reportedly prioritized USDT and USDC, routing those stablecoins through intermediate wallets before swapping them on decentralized exchanges for assets including ETH and TRX. That sequence would reduce exposure to issuer-controlled tokens, whose operators can blacklist addresses and freeze balances under certain circumstances.
The movement also reflects the different security models across crypto networks. Stablecoin issuers can intervene at the token-contract level, while native assets such as Bitcoin, Ether and TRX generally cannot be frozen by a central issuer once transferred on-chain. Some Layer 2 networks and bridge systems retain emergency controls, but those tools depend on detection and rapid coordination.
Tron and Ethereum formed major transfer routes
Tron accounted for one of the largest reported conversion paths. According to the report, approximately $234 million in USDT was exchanged for 638 million TRX, then divided among multiple wallets and routed through at least six cross-chain services, including THORChain. Much of the value later appeared on Ethereum as ETH.
Other assets followed separate paths into Ethereum. Funds originating on Base were reportedly bridged through Stargate before being consolidated into around 1,187 ETH. Avalanche-based holdings were first exchanged into USDC, transferred through Circle's Cross-Chain Transfer Protocol, known as CCTP, and then swapped for about 7,243 ETH.
Bridges allow users to move value between otherwise separate blockchains. They also create a complex tracing environment when a large number of transfers are divided among fresh addresses, processed through multiple protocols and reconverted into different assets.
The alleged operators continued splitting balances after those bridge transfers. One ETH batch swapped through THORChain was distributed across 35 addresses, while another batch routed through Relay was exchanged for ETH using CoW Swap and divided among 16 additional wallets, according to the report.
Automated transfers increased the response challenge
Elliptic reported automation markers associated with transactions from the main Tron distribution wallet. Between Oct. 30 and Nov. 1, that wallet executed more than 1,100 transactions, Elliptic said, while newly funded addresses commonly sent funds onward within two minutes.
That pace can place pressure on both risk-monitoring systems and service providers. A freeze request or blacklist may stop assets held at a known address, but a fast-moving operation can already have distributed portions of the balance to new wallets or exchanged them for native tokens.
On Oct. 31, the FBI, U.S. Secret Service and IRS Criminal Investigation published wallet addresses tied to the North Korea-linked activity and urged THORNode operators, remote procedure call providers, instant-swap services and DeFi platforms to block related transactions.
Responses were uneven. Symbiosis said it identified an attempted transfer through its system and contacted Binance, according to the report. On-chain activity nevertheless indicated that funds continued to move through Relay, despite address risk-screening features cited in the supplied account.
THORChain again faces scrutiny over illicit flows
THORChain featured prominently in the alleged laundering routes, continuing a pattern that has drawn criticism from blockchain investigators and law-enforcement agencies. The protocol enables swaps among native assets across multiple chains without requiring users to deposit funds with a centralized intermediary.
According to figures in the report, THORChain generated about $9.27 billion in trading volume and $12.47 million in fees connected to seven hacking or fraud cases from 2023 through 2026. Those cases included flows associated with FTX, Bybit and Kelp DAO. The 2025 Bybit theft alone generated roughly $8.63 million in THORChain fees, the report said.
An interruption to THORChain activity during the incident was attributed to a technical event rather than enforcement. A 10 ETH abnormal refund coincided with an Ethereum block reorganization on Oct. 31 and triggered an emergency pause mechanism. By Nov. 1, transactions involving Bitcoin, Ethereum, Tron and 10 chains in total remained affected, according to the supplied account.
The episode illustrates the limits of relying on individual protocols to police large-scale laundering. Even when a service pauses or blocks an address, funds may have already crossed several chains and reached wallets beyond that system's control.
Past investigations point to off-chain cash-out networks
Cross-chain transfers generally form one stage of a broader laundering process. U.S. enforcement actions and sanctions-monitoring reports have documented cases in which North Korea-linked operators used mixers, peer-to-peer traders, over-the-counter brokers and overseas intermediaries to convert digital assets into fiat currency.
In April 2025, Ben Zhou, chief executive of Bybit, said that about 28% of the assets stolen from the exchange had become difficult to trace, largely after passing through mixers and bridges before reaching peer-to-peer and over-the-counter channels.
An October 2025 report by the 11-nation Multilateral Sanctions Monitoring Team said North Korea-linked actors had arranged the cash-out of more than $100 million in Bybit-related proceeds through a Hong Kong intermediary as of April 2025. The monitoring group also identified at least $60 million in cryptocurrency processed through a Russian intermediary, including funds connected to the same theft.
The group described a separate Cambodia-based arrangement in which a North Korean national helped consolidate crypto in designated wallets before arranging fiat exchanges through other jurisdictions, including Hong Kong.
Earlier U.S. Treasury action described similar methods following a 2018 Lazarus-linked exchange theft of about $250 million. Treasury said roughly $91 million was sent to two Chinese intermediaries. One intermediary moved more than $34 million through bank accounts and converted some Bitcoin into Apple iTunes gift cards.
The reported Binance flows had not yet reached a clear final cash-out stage in the account provided. Their continued movement through swaps, bridges and fragmented wallets points to an operation designed to preserve flexibility while complicating efforts to identify where stolen funds may ultimately be exchanged for fiat.
Concerned about large-scale exchange breaches? Learn how crypto safety standards can protect your assets from sophisticated laundering operations.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
