North Korean hackers moved about $242 million in assets stolen from Binance through the TRON blockchain over two days, using cross-chain bridges, decentralized swap services and new wallets even as the FBI urged infrastructure operators to block addresses connected to the theft.
Onchain analyst SomaXBT estimated that roughly $194 million of the funds had left TRON through bridges and swap protocols, while about $26 million remained on the network. Another $22 million was lost through transaction fees, trading slippage and price movements during the laundering process.
The activity followed the FBI's attribution of the attack to TraderTraitor, a North Korean state-sponsored hacking group also tracked as Lazarus Group, APT38 and BlueNoroff. In an alert issued with the U.S. Secret Service and IRS Criminal Investigation, the bureau said the stolen assets were being converted primarily into Ethereum and could be moved further through decentralized finance protocols and instant swap services.
The FBI published 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address tied to the attack. Its list did not include TRON wallets, even though blockchain analysts identified TRON as a central route in the early laundering activity.
Freeze action left attackers with hundreds of millions to move
SomaXBT said the attackers initially controlled about $628 million on TRON after the breach. Tether later froze 378.7 million USDT across two wallets, according to TRON blockchain records, leaving the group with roughly $249 million available for transfers.
Tronscan shows that one wallet held 312.7 million frozen USDT and another held 65.99 million USDT. The freeze restricted access to a substantial share of the stolen stablecoins, but the attackers had already begun converting and routing other funds through systems designed to exchange assets between blockchains.
Chainalysis said the group deposited stablecoins into TRON-based DeFi protocols in return for receipt tokens, which can be transferred even when the underlying stablecoins are subject to issuer controls. TRM Labs separately reported that 300 million USDT was moved to a TRON address that began supplying assets to the JustLend lending protocol.
Blockchain records cited in the supplied material show that wallet deposited 10,000 USDT into JustLend, swapped about 234 million USDT for TRX through decentralized exchanges, and sent 65.99 million USDT to one of the wallets later frozen by Tether.
The approach places stablecoin issuers and protocol operators in a race against laundering operations that can split assets across hundreds or thousands of transactions. Elliptic said the main TRON distribution wallet made transfers every hour for 31 consecutive hours, with no break longer than 46 minutes.
Bridges carried funds toward Ethereum and Bitcoin
SomaXBT identified Relay, THORChain, Chainflip and Symbiosis as the principal services used to move assets away from TRON. Together, those protocols handled about $140 million of the estimated outflows.
Relay processed about $48 million, THORChain handled $44 million, Chainflip received $32.1 million and Symbiosis carried roughly $16 million, according to SomaXBT. Bitget Wallet processed another $41.7 million, although the ultimate destination of those funds had not been resolved in the analyst's tracking.
THORChain received 185.1 million TRX and 3.83 million USDT in 2,697 deposits, SomaXBT said. The protocol subsequently paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses.
The volume came as THORChain faced disruption from an unrelated technical event. Chainalysis said an Ethereum chain reorganization caused THORChain to double-refund a 10 ETH deposit, prompting an emergency pause. Node data showed trading halted on 10 of THORChain's 13 connected networks on Sunday, including TRON, Ethereum and Bitcoin. Swaps originating from TRON had been halted since around midday Saturday.
Chad Barraford, technical co-founder of THORChain, wrote that THORNode operators had zero information that is not already public and readily available in real time. He did not say whether node operators would block the FBI-listed addresses.
THORChain has faced scrutiny in prior North Korean-linked laundering cases. Blockchain tracking linked the protocol to conversions of ether into Bitcoin after the February 2025 Bybit theft, which the FBI also attributed to TraderTraitor.
Relay transactions point to fresh Ethereum wallets
Relay received 37.64 million USDT and 39.28 million TRX in 735 deposits, according to SomaXBT. Etherscan records cited in the supplied material show one Ethereum wallet received 2,804 ETH and 1.02 million USDT through 97 payments from Relay routers and solvers over roughly 80 minutes.
That wallet exchanged the USDT for ether through CoW Protocol, then distributed about 3,257 ETH, valued at approximately $7.4 million at the time, across four newly created addresses. None of the five wallets appeared on the FBI's published address list.
Lookonchain also reported that the attackers began swapping 970,522 SOL, worth about $95.9 million, for Bitcoin through Relay on Sunday. The Solana address named by the FBI moved 486,970 SOL in the hour before Lookonchain's post and retained about 466,700 SOL, according to Solscan data cited in the material.
Chainflip received 49.47 million USDT in 571 deposits, SomaXBT said. Many swaps failed, with 17.91 million USDT refunded to newly created TRON wallets before being sent back into the system. Elliptic described repeated transaction amounts and automated resubmissions after rejected bridge deposits, a pattern it said differed from the more human-timed laundering behavior observed after the Bybit attack.
Frozen funds expose limits of asset recovery
Elliptic said it had verified $2.85 billion in stolen assets as frozen or seized, equal to about 44% of the $6.43 billion in thefts it tracks. Stablecoins accounted for 94% of that frozen or seized total, according to the firm.
The remaining assets demonstrate why recoveries become more difficult once funds are converted into tokens without issuer-level freeze mechanisms. Elliptic said no funds had been frozen on Bitcoin, the XRP Ledger, Solana or NEAR, and estimated that about $3.25 billion in stolen assets remained in forms without comparable issuer controls.
Mempool.space data cited in the supplied material showed that nearly all of the 18,270 BTC connected to the FBI's published Bitcoin addresses remained in place. The laundering effort has instead concentrated on assets that can be rapidly swapped, bridged and dispersed among newly created wallets, reducing the effectiveness of address-based blocking after funds leave their original chain.
Worried about hacks like this? Learn how crypto safety practices can better protect your funds across chains.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
