North Korean hackers launder $242 million from Binance through Tron and THORChain

Following an historic $6.3 billion exploit of Binance attributed to North Korea's TraderTraitor group, hackers actively launder funds across decentralized protocols. While Tether and Circle froze up to $3 billion in stablecoins, the attackers converted hundreds of millions into unfreezable TRX and SOL, routing assets through cross-chain bridges like Relay, THORChain, and Chainflip. Despite FBI pressure to blacklist attacker wallets, node compliance remains mixed while technical glitches temporarily halted THORChain operations.

Laundering stolen funds on Tron

• ▪Elliptic said the October 29, 2026 Binance hackers' primary Tron distribution wallet executed automated payouts every hour for 31 consecutive hours without pausing for longer than 46 minutes
• ▪Hackers swapped 234 million stolen USDT for an estimated 638 million TRX on decentralized exchanges on Tron to convert freezable stablecoins into native tokens
• ▪Hackers moved 120 million TRX from a wallet tied to the October 29, 2026 Binance hack to an unknown address
• ▪Onchain analyst SomaXBT said North Korean hackers laundered approximately $242 million of stolen Binance funds on the Tron blockchain over two days following the October 29, 2026 Binance hack

Asset freezes and evasive tactics

• ▪Hackers deposited stablecoins into Tron DeFi protocols like JustLend for non-freezable depository receipt tokens to evade issuer freezes
• ▪Onchain analyst SomaXBT said Tether froze 378.7 million USDT across two attacker wallets on the Tron network, leaving the October 29, 2026 Binance hackers with roughly $249 million to move
• ▪Stablecoin issuers Tether and Circle froze between $2.7 billion and $3 billion in stolen stablecoins following the October 29, 2026 Binance attack

Sanctions and THORChain's reaction

• ▪The FBI published a sanctions list of 608 Ethereum, 19 Bitcoin, and 1 Solana address tied to the October 29, 2026 Binance hack, specifically urging DeFi platforms, node operators, THORChain THORNode operators, and RPC nodes to block them
• ▪THORChain technical co-founder Chad Barraford stated node operators possess no private intelligence beyond public onchain data, refraining from committing to explicit address blocks

THORChain emergency trading pause

• ▪An Ethereum chain reorganization caused THORChain to double-refund a 10 ETH deposit on October 31, 2026, triggering an emergency pause across 10 connected chains
• ▪THORChain's emergency pause halted trading on chains including Tron, Ethereum, and Bitcoin, temporarily preventing further laundering by the October 29, 2026 Binance hackers

The hack and initial response

• ▪North Korean hackers attributed to the state-sponsored TraderTraitor group stole approximately $6.3 billion from Binance on October 29, 2026, marking the largest cryptocurrency hack on record
• ▪The FBI, U.S. Secret Service, and IRS Criminal Investigation formally attributed the October 29, 2026 Binance breach to North Korea's TraderTraitor group on October 31, 2026
• ▪Binance identified a compromised DevOps laptop as the potential initial attack vector for the October 29, 2026 exploit of Binance's hot wallets
• ▪Binance set aside over $6.34 billion in company funds to cover all customer losses resulting from the October 29, 2026 breach of Binance's hot wallets