North Korea-linked hackers laundered about $242 million over two days following the Oct. 29, 2026, Binance hack, according to onchain analyst SomaXBT, who is involved in the Security Alliance initiative. The movement of the funds through Tron and cross-chain services prompted the FBI to urge THORChain node operators and other crypto services to block transactions linked to the attack.

The attackers withdrew about $628 million from Binance on the Tron network, SomaXBT reported. Tether froze 378.7 million USDT, leaving the hackers with roughly $249 million in accessible assets.

Of the $242 million tracked over the two-day period, about $194 million moved out of Tron through bridges and swap services. Another $26 million remained on the network, while roughly $22 million was lost to fees, slippage and changes in asset values.

Relay handled $48 million, THORChain $44 million, Chainflip $32.1 million and Symbiosis $16 million, for a combined total of about $140 million. Another $41.7 million went through Bitget Wallet, though SomaXBT said he could not determine the funds’ final destination.

The attackers sent 185.1 million TRX and 3.83 million USDT into THORChain in 2,697 deposits. The protocol subsequently paid 17,019 ETH to 170 addresses and 53.25 BTC to 20 wallets.

SomaXBT estimated that the hackers lost about 12% of the funds routed through THORChain to fees and slippage. Interfaces used to execute the transactions received about 145,800 RUNE, worth $95,000, in affiliate rewards.

THORChain technical co-founder Chad Barraford said node operators have access only to publicly available transaction information. He did not say whether they intended to block the addresses identified by the FBI.

Symbiosis acknowledged shortcomings in its transaction-verification mechanisms. The project said it was coordinating with Binance and working to address the identified issues.

Binance hack

Binance was hit on Oct. 29, 2026, by the largest hacking attack in the history of the crypto market. TRM Labs analysts estimated that attackers stole about $6.36 billion across 10 blockchains, moving most of the assets out in roughly 20 minutes.

Ethereum accounted for the largest losses, at about $3.79 billion. Attackers also stole about $1.47 billion in bitcoin and roughly $628 million on the Tron network.

Binance’s preliminary account said the attackers may have accessed internal infrastructure through a compromised laptop belonging to a DevOps engineer. Investigators later identified other potential entry points, while the exchange said it found no evidence that wallet private keys had leaked.

Blockaid specialists disclosed the mechanism used to withdraw about $2.5 billion from one Binance hot wallet. The attacker used 50 EIP-7702 authorizations to redirect assets through a pre-prepared smart contract.

The FBI later attributed the attack to TraderTraitor, a group linked to the Democratic People’s Republic of Korea. The agency published a list of suspicious addresses and urged crypto companies to prevent further movement of the stolen funds.

During the investigation, THORChain also suspended operations across 10 networks after an Ethereum block reorganization caused an erroneous refund of 10 ETH to a user. The funds were later returned, but the restrictions remained in place pending a fix for the vulnerability.

Source: Incrypted