North Korean Hackers Launder $242 Million Stolen From Binance Using Cross-Chain Services

North Korean hackers laundered about $242 million in crypto stolen from Binance in just two days.

The Block reported on November 1 that on-chain analyst SomaXBT, a contributor to security coalition SEAL, said the hackers moved about $242 million of the funds stolen on the Tron blockchain. The group stole about $628 million on Tron and was still able to move roughly $249 million after Tether froze 378.7 million USDT.

According to SomaXBT, about $194 million of the moved funds was routed to other blockchains through bridge and swap services. About $26 million remained on Tron, while the remaining $22 million was likely consumed by transaction fees, slippage and price fluctuations.

Several cross-chain services were used in the laundering process. About $48 million moved through Relay, $44 million through THORChain, $32.1 million through Chainflip and $16 million through Symbiosis. Another $41.7 million was processed through Bitget Wallet, though the final route of those funds could not be identified.

The FBI identified the North Korean hacking group TraderTraitor as being behind the attack and urged firms to block transactions tied to the funds. It said the hackers were converting the stolen assets mainly into Ether and asked THORChain node operators, decentralized finance services and crypto exchange providers to cooperate.

Automated trading patterns were also detected during the laundering process. Blockchain analytics firm Elliptic said the hackers' main Tron wallet sent funds every hour for 31 straight hours, and when a transaction was rejected, the money was resent through a new wallet along the same route. Elliptic co-founder Tom Robinson said the activity appeared to be directed by people, with automated scripts handling repetitive tasks rather than AI agents.

The case has also raised questions about anti-money-laundering controls at some cross-chain services. Symbiosis said it had detected attempts to move hack-related funds and was working with Binance, while acknowledging limits in its existing monitoring systems in tracking a fast-moving, sophisticated attack. THORChain, meanwhile, had halted transactions on 10 of its 13 connected networks because of a separate technical issue.

Separately, Elliptic said about $2.85 billion of the roughly $6.43 billion in total stolen assets had been frozen or seized. That amounts to about 44% of the total. Still, a sizable share remains in assets such as Bitcoin and XRP that cannot be frozen directly by their issuers, and monitoring continues over the risk of further laundering.