North Korea moves $242M of Binance loot through Tron; FBI tells THORChain operators to block

The North Korean group TraderTraitor, the sub-unit of Lazarus the FBI named on October 31 as the actor behind the $6.3 billion Binance hot-wallet theft, has moved roughly $242 million of the stolen funds through Tron over the last two days, with about $194 million already bridged out of Tron and $140 million of that traced through four named bridges. The attribution comes from independent on-chain analyst SomaXBT, a contributor to the Security Alliance (SEAL), and was published in a Sunday post on X that is reported in parallel by The Block and The Defiant. The analyst's framing lines up with the FBI Cyber Division alert of October 31 that explicitly asked THORNode operators, cross-chain RPC node operators, and instant-exchange services to filter transactions tied to the attacker addresses — a request Blockchain Posts covered in this morning's post on the FBI attribution and blocklist.

The Tron routing, bridge by bridge

Per SomaXBT's breakdown, the ~$140 million that has already left Tron for other chains splits as:

• Relay: $48 million
• THORChain: $44 million
• Chainflip: $32.1 million
• Symbiosis: $16 million

A further $41.7 million moved into Bitget Wallet addresses that the analyst flags as unresolved — i.e., still sitting on Tron or in flight into another destination not yet attributed. Of the roughly $242 million that transited Tron in total, the remainder is funds that have not left Tron yet or that moved through smaller routes.

TraderTraitor's post-Tron destination is overwhelmingly Ethereum, matching the FBI's own characterisation of the group converting its holdings "primarily into Ethereum." Addresses relevant to the hunt include:

• Ethereum: 0xc8D516a53e28909d9eAB92642938762eA36F9093 (associated by analysts with the hacker; not on the FBI's published list).
• Solana: AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU (the single Solana address the FBI published).
• Tron (JustLend-linked, cited by SomaXBT): TG5iBMQPrDzJJAUM8GMVBf1hRaJ1wvzsGi, TCzBTkqn66yApqbYoPezaEQosM5DAd7Y62, TPBkSjkCMn2ckrMuAP8n2J1jdjbw76bKN4.

Why the FBI is pointing at THORChain

THORChain is a cross-chain swap network whose liquidity pools are provided by community operators and whose transactions are routed by a quorum of THORNodes. There is no custodian who can freeze funds in flight; the only intervention point is the node set that produces blocks and the exchanges that quote THORChain-sourced liquidity. The FBI's October 31 advisory asks THORNode operators to block transactions associated with the published attacker addresses — a request the network's governance would have to collectively honour for it to have effect. The protocol's history with Lazarus is long: THORChain carried ~$900 million of the Bybit hack proceeds in February 2025, and the FBI issued a similar advisory then.

Relay, Chainflip and Symbiosis are also non-custodial swap routes; the enforcement surface is likewise the node or market-maker set, not the protocol contracts.

Numbers block

- Binance hack total              : $6.3B (29 October 2026)
- FBI attribution                 : TraderTraitor / Lazarus (31 October 2026)
- Through Tron (2-day window)     : ~$242M
- Bridged off Tron                : ~$194M
- Of which, four named bridges    : $140M total
  - Relay                         : $48M
  - THORChain                     : $44M
  - Chainflip                     : $32.1M
  - Symbiosis                     : $16M
- Bitget Wallet (unresolved)      : $41.7M

Rate reference for the aggregates: the dollar values are the analyst's at-flow conversions; token-level amounts were not disclosed in the public write-up.

Impact

For custodial exchanges: the FBI's address list is the enforcement surface. Centralised venues that accept Tron-, Ethereum- or Solana-side deposits from the published addresses are the natural chokepoint; several (Tether and Circle have already frozen on-chain balances, per prior reporting on this hack) have acted on the Ethereum side.

For bridges and swap networks: Relay, THORChain, Chainflip and Symbiosis each have different operator-governance surfaces. THORChain's node set is the most politically visible target because of the Bybit precedent; the FBI's wording this time is firmer and names operators specifically.

For DeFi integrators: pools that quote THORChain liquidity (aggregators routing through RUNE pools, aggregator front-ends such as 1inch Fusion, and native THORSwap integrators) will have to decide, protocol by protocol, whether to depeer the flagged liquidity. There is no automatic mechanism.

What to watch

1. Whether the THORNode operator set passes a filtering motion for the FBI's address list, and the vote tally if it does.
2. Movement at the three Tron hub addresses above — further bridge-outs will likely retrace the same four routes.
3. Relay's posture: at $48 million it is the largest named route in this flow, and Relay has not previously drawn FBI attention of this specificity.
4. The Bitget Wallet $41.7M — whether it clears to Bitget-controlled hot wallets (freezable) or threads out through secondary wrappers.

Context — the Lazarus bridge pattern

TraderTraitor's choice of Tron first and THORChain-style non-custodial bridges second is the exact pattern the group used after Bybit in February 2025 and after the DMM Bitcoin hack in May 2024. The reason is operational, not aesthetic: non-custodial bridges have no freeze lever, their operator sets are geographically diffuse, and in historical cases the time cost of coordinating a social filter has exceeded the time cost of swapping assets through them. The FBI's advisory this time is more specific than the Bybit-era one, and the Oct 31 list it published is machine-readable. Whether that produces different operator behaviour is the open question.