TL;DR: North Korea’s Binance hackers have moved roughly $242 million of the stolen $6.3 billion through the Tron blockchain over the past two days, routing it through bridges like Relay, THORChain and Chainflip to reach assets no one can freeze. The FBI’s weekend alert named 608 Ethereum addresses and 19 Bitcoin addresses to block, but zero on Tron, which happens to be the exact chain where the laundering is moving fastest.
The Binance hack keeps generating new chapters, and this one is about the part that’s hardest to stop: turning stolen crypto into money the thieves can actually spend. On-chain analyst SomaXBT traced about $242 million leaving Tron in the last 48 hours, out of roughly $628 million the attackers originally pulled out on that chain in the first place. Tether had already frozen 378.7 million USDT tied to the hack, which left about $249 million free to move. Almost all of it did, in a hurry.
The breakdown is specific enough to follow closely. Around $194 million left Tron entirely through bridges and swap services, $26 million is still sitting on Tron waiting to move, and roughly $22 million evaporated into fees, slippage and price swings along the way. Of the money that moved, Relay handled about $48 million, THORChain processed $44 million, Chainflip took $32.1 million and Symbiosis moved $16 million, adding up to around $140 million combined through those four services alone. Another $41.7 million went into Bitget Wallet, and nobody tracking the funds has figured out where it went from there.
The FBI named addresses, but not the ones that matter here
Over the weekend, the FBI, Secret Service and IRS Criminal Investigation issued a joint alert asking THORNode operators, RPC providers, instant-swap services and other DeFi platforms to block transactions tied to the theft. The list ran 608 Ethereum addresses, 19 Bitcoin addresses and a single Solana address. It did not include a single Tron address, even though Tron is where a huge chunk of the laundering has been happening in plain sight. As we covered when the FBI first published its blocklist and formally pinned the hack on North Korea, the bureau’s whole approach so far has been to publish addresses and ask the industry to self-police rather than issue anything with actual legal force behind it.
THORChain co-founder Chad Barraford responded publicly that node operators have “zero information that isn’t already public,” and he hasn’t said whether the network plans to act on the FBI’s request at all. THORChain is already in an odd spot of its own making: it halted operations on 10 of its 13 supported chains, Tron included, after a separate incident where an Ethereum blockchain reorg caused a 10 ETH deposit to get refunded twice. Even with that halt in place, on-chain records show THORChain took in 185.1 million TRX and 3.83 million USDT across 2,697 separate deposits tied to the hack, and paid out 17,019 ETH and 53.25 BTC on the other side of those swaps.
The lone Solana address on the FBI’s list got activity too. Tracking service Lookonchain spotted 970,522 SOL, worth about $95.9 million, getting swapped into Bitcoin through Relay over the weekend, meaning that address is being actively drained even as it sits on a government watch list.
Why Tron, specifically
Tron has become the default rail for crypto launderers for reasons that have nothing to do with this particular hack. Its transaction fees are a fraction of a cent, its blocks confirm in seconds, and it carries more stablecoin volume globally than almost any other chain, which makes large USDT movements blend into ordinary traffic instead of standing out. That same design, built for cheap, fast, high-volume transfers, is exactly what makes it useful for anyone trying to move nine figures without tripping alarms. North Korea’s Lazarus Group and its offshoots have leaned on Tron before, and the speed at which $242 million cleared the chain this weekend suggests the playbook hasn’t changed.
Where the recovery numbers actually stand
Blockchain analytics firm Elliptic now says $2.85 billion, or about 44% of the roughly $6.43 billion total it tracks for the hack, has been frozen or seized by exchanges and issuers so far. That leaves close to $3.25 billion that nobody has managed to lock down, and a meaningful chunk of that is sitting in what Chainalysis describes as Tron DeFi receipt tokens, a type of asset that simply can’t be frozen the way a stablecoin issuer can freeze USDT on command. Other researchers have pointed to a specific destination worth watching: a wallet that received roughly 300 million USDT before supplying it into JustLend, Tron’s largest lending protocol, according to TRM Labs. Separately, Elliptic researcher Tom Robinson flagged that the wallet handling Tron payouts has been running on an hourly schedule for 31 straight hours, precise enough that Robinson said it doesn’t look like manual trading, though he stopped short of calling it an automated agent outright.
Put together, the math isn’t encouraging for anyone hoping this gets cleaned up quickly. Nearly half the stolen funds being locked down sounds like real progress, right up until you compare it to Binance’s own messaging about how much of the hole it has already patched on its own balance sheet using company reserves, separate from whatever investigators actually claw back from the thieves. Freezing a stablecoin and physically recovering crypto that’s already routed through DeFi are two very different problems, and this weekend is a good demonstration of why. Binance customers are also only partway through getting their money back; bitcoin withdrawals reopened in a phased rollout that started Sunday, with other assets still waiting their turn.
The bottom line
This is the part of every major crypto hack that gets less attention than the breach itself, and it shouldn’t. Binance can replace what it lost from its own reserves and keep customers whole, which is the headline most people actually care about. But $242 million moving through Tron in 48 hours, bridges that will happily route sanctioned funds without asking a single question, and an FBI list that somehow skips the one chain where the laundering is fastest tell you who’s actually winning this particular race right now. It isn’t the investigators.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
