Binance hack laundering: $242m moved through Tron in two days

Attackers laundered about $242m of the money stolen from Binance on Tron within two days, blockchain analyst SomaXBT wrote on X on Sunday 1 November. Most of it left Tron through cross-chain bridges and swap services, The Block reported.

Binance hack laundering on Tron covers a small slice of the theft. The attackers took about $628m on the network, roughly 10% of the $6.3bn stolen in the Binance hack on Thursday. Tether then froze 378.7m USDT in two wallets, which left about $249m free to move.

By our count, the attackers moved 97% of that free money in two days.

Where the money went

• Relay: $48m.
• THORChain: $44m.
• Chainflip: $32.1m.
• Symbiosis: $16m.
• Bitget Wallet: $41.7m, destination not yet traced.

About $194m left Tron through bridges and swaps, and about $26m stayed on the network. Around $22m went on fees, slippage and price moves, about 9% of the laundered sum. The four largest routes carried about $140m, or 72% of what left Tron.

SomaXBT's map traces 12,043 attacker wallets and shows those that moved $250,000 or more. Elliptic said the main Tron distribution wallet paid out every hour for 31 hours, with no pause longer than 46 minutes. Elliptic co-founder Tom Robinson described "operators making decisions, with scripts doing the repetitive work."

THORChain under pressure

On 31 October the FBI attributed the theft to North Korea's TraderTraitor group and urged THORChain node operators, exchanges and other services to block transactions tied to it. The FBI list has 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. It has no Tron addresses.

THORChain technical co-founder Chad Barraford answered that node operators "have zero information that isn't already public." The network has since halted trading on 10 of its 13 chains, Tron among them, for a separate reason: an Ethereum block reorganisation on 31 October left its vault 10 ETH short, and the user returned the coins. THORChain cannot block single transactions, so its emergency controls stop whole networks.

On Tron alone, the attackers sent 185.1m TRX and 3.83m USDT into THORChain across 2,697 transactions and took out ETH and BTC, according to on-chain data cited by Crypto Adventure. THORChain played the same role in February 2025, when the Lazarus group pushed most of the $1.5bn stolen from Bybit through it.

“Our screening is built for normal flows, not for tracking fast-moving, sophisticated attempts so some mechanisms have gaps.”

— Symbiosis, on X · theblock.co

If you swap through Relay, THORChain or Chainflip, your trade uses the same pools as this money. A halt like THORChain's stops your swap too.

SomaXBT's figures are an independent analyst's on-chain count, not official data.