TRON (TRX): Binance Hackers Launder $242M Through Cross-Chain Bridges

By Nodora News · 2 November 2026

North Korea-linked hackers moved about $242M of stolen Binance funds through TRON (TRX) in two days, mostly via Relay, THORChain, Chainflip and Symbiosis.

Hackers linked to North Korea have pushed about $242 million of the funds stolen from Binance through the TRON (TRX) blockchain in just two days, according to on-chain analyst SomaXBT, a contributor to the Security Alliance (SEAL). About $140 million of that left Tron through four cross-chain bridges and swap services, even as the FBI urges those services to block any transactions tied to the record $6.3 billion theft.

Key takeaways

• About $628 million of the Binance loot landed on Tron, and Tether froze 378.7 million USDT of it, leaving roughly $249 million the attackers could still move.
• Around $242 million of that has been laundered in two days, with about $194 million leaving Tron through bridges and swap services.
• Relay ($48 million), THORChain ($44 million), Chainflip ($32.1 million) and Symbiosis ($16 million) handled about $140 million between them.
• The FBI has asked THORChain node operators and other crypto services to block addresses tied to the hack, but its list includes no Tron addresses.
• TRX trades near $0.3126 on OKX, up about 1.7% in 24 hours, so the flows have not knocked the price.

How the Binance hackers are moving funds off Tron

When attackers drained Binance's hot wallets late on October 29, a large slice of the haul was USDT, the dollar-pegged stablecoin, sitting on Tron. Stablecoins can be frozen by their issuer, and Tether moved quickly, locking 378.7 million USDT across two attacker wallets.

The rest was a race. SomaXBT's tracking shows the hackers swapping what they could into TRX, the Tron network's own token, and other assets that cannot be frozen, then splitting it into thousands of small deposits sent to cross-chain services. These services, often called bridges, take coins on one blockchain and pay out coins on another, in this case mainly Ether (ETH) and Bitcoin (BTC).

Nodora reported earlier on how the Binance hacker swapped 234 million USDT into TRX. This latest data shows where much of that TRX went next.

The numbers: where the $242 million went

Based on SomaXBT's figures, as reported by The Block:

• Relay: about $48 million, from 37.64 million USDT and 39.28 million TRX in 735 deposits
• THORChain: about $44 million, from 185.1 million TRX and 3.83 million USDT in 2,697 deposits, with 17,019 ETH and 53.25 BTC paid out
• Chainflip: about $32.1 million, though many swaps failed and were refunded to fresh wallets and re-sent
• Symbiosis: about $16 million, from 49.71 million TRX in 1,367 small deposits
• Bitget Wallet: another $41.7 million, with its final destination still unresolved
• Left on Tron: about $26 million, with roughly $22 million lost to fees, slippage and price moves

Blockchain analytics firm Elliptic says the laundering looks heavily scripted. The attackers' main Tron wallet paid out every hour for 31 hours straight and never paused for more than 46 minutes, and rejected deposits were automatically re-sent from new wallets. Elliptic co-founder Tom Robinson told The Block the pattern points to human operators using scripts, not AI agents.

The movement is not limited to Tron. Lookonchain reported on Sunday that the hackers began swapping about 970,500 SOL, worth roughly $96 million, into bitcoin through Relay, from the only Solana wallet on the FBI's list.

Why it matters: the FBI, THORChain and freezes

On Saturday, October 31, the FBI, the US Secret Service and IRS Criminal Investigation formally blamed North Korea's TraderTraitor group, also tracked as Lazarus Group, for the attack. The alert said the hackers were converting assets mainly into Ether and asked THORChain node operators, RPC providers, instant exchanges and DeFi services to block transactions linked to the theft. It listed 608 Ethereum addresses, 19 bitcoin addresses and one Solana address, but none on Tron.

THORChain is in an awkward spot. It is a decentralized network with no way to block a single sender, so node operators can only pause a whole chain or the full network. Technical co-founder Chad Barraford has said operators hold no private information, but has not said whether they would act on the FBI list. Ironically, an Ethereum block reorganization on October 31 caused THORChain to refund one 10 ETH deposit twice, triggering an emergency pause that Chainalysis said also slowed the hackers. Trading stayed halted on 10 of its 13 chains, including Tron, as of Sunday afternoon US time.

Symbiosis said it had spotted attempts to route hack funds through its protocol, admitted its screening "has gaps", and said it was working with Binance to close them.

Across the whole hack, Elliptic counts about $2.85 billion frozen or seized, roughly 44% of the $6.43 billion it tracks as stolen, and 94% of that is stablecoins. About $3.25 billion sits in assets no issuer can freeze, including 18,327 BTC and 233 million XRP. The 18,270 BTC taken directly from Binance has not moved from the 19 addresses on the FBI's list.

Market reaction: TRX steady as laundering continues

Prices have shrugged off the laundering news so far. On OKX at the time of writing:

• TRON (TRX): about $0.3126, up roughly 1.7% in 24 hours
• Ethereum (ETH): about $2,258, up roughly 0.3%
• Bitcoin (BTC): about $77,740, up roughly 0.3%
• Solana (SOL): about $93.85, down roughly 2%

TRX fell about 9% in a single day after the hacker piled into the token, and has since steadied. For users, Binance says it has replaced about 95% of the stolen assets from its own funds and has restarted withdrawals in phases. You can follow live prices on Nodora Charts.

What to watch next

• THORChain's response: whether node operators keep chains paused, restart them, or act on the FBI's address list.
• The frozen bitcoin question: the 18,270 BTC in FBI-listed wallets has not moved; any transfer would be a major signal.
• Ether conversions: the FBI expects the funds to be laundered further through DeFi and swap services, so watch for mixer deposits.
• Binance's proof of reserves: a full zero-knowledge proof, letting users check their own balances are backed, is expected around November 3.

This article is for information only and is not financial advice.

#TRON #Binance #Hack #THORChain #North Korea

This article is general information, not financial advice.