DPRK Hackers Launder $242 Million of Binance Funds via Tron
Within 48 hours of the theft, North Korea's TraderTraitor group had already moved $242 million of the funds stolen from Binance across the Tron blockchain and through a cluster of cross-chain bridges, according to onchain analyst SomaXBT. The scale and speed of the operation have drawn a direct FBI intervention, forcing compliance teams to re-examine their exposure to DeFi routing infrastructure and their obligations under U.S. sanctions law, right now.
What Happened: The Theft and Immediate Laundering Route
The attackers extracted roughly $6.3 billion from Binance in the underlying incident. On Tron alone, they initially held approximately $628 million. Tether moved quickly, freezing 378.7 million USDT across two attacker wallets, which left the group with an estimated $249 million still available to move on Tron. Of that, $242 million was laundered within two days, according to SomaXBT's onchain analysis.
How the $242 million broke down
The analyst's breakdown of the $242 million shows three broad destinations. About $194 million left Tron entirely through bridges and swap services. Approximately $26 million remained on the Tron network at the time of reporting. The remaining $22 million was consumed by fees, slippage, and adverse price movement during execution.
Four cross-chain services collectively routed about $140 million of the outflows off Tron. Relay handled the largest single share at $48 million, receiving 37.64 million USDT and 39.28 million TRX across 735 deposits. THORChain processed $44 million, with the attackers sending 185.1 million TRX and 3.83 million USDT in 2,697 individual deposits. Chainflip received 49.47 million USDT in 571 deposits, though a large portion of those swaps failed and funds were refunded to fresh Tron wallets before being re-submitted. Symbiosis processed approximately $16 million in 1,367 smaller deposits of TRX. A further $41.7 million moved through Bitget Wallet, though its ultimate destination had not been confirmed by the time of reporting.
On the receiving side of the THORChain flows, the protocol paid out 17,019 ETH to 170 Ethereum addresses and 53.25 BTC to 20 Bitcoin addresses. The hackers absorbed roughly a 12% cost to fees and slippage across those transactions. Front-end interfaces earned around 145,800 RUNE, approximately $95,000, in affiliate fees on those same flows.
The Solana pivot
Separately, on Sunday, the attackers began converting 970,522 SOL, worth approximately $95.9 million, into Bitcoin via Relay-powered swaps. The hackers' Solana wallet, the only Solana address the FBI publicly listed, moved 486,970 SOL in the hour before an early Sunday morning post by blockchain monitoring account Lookonchain. The swaps continued after the FBI had already published the wallet address, a signal of the group's confidence in the speed of their execution versus the speed of any response.
FBI Attribution and the BlockList Request
The FBI formally attributed the theft to TraderTraitor on Saturday in an advisory issued jointly with the U.S. Secret Service and IRS Criminal Investigation. The advisory describes TraderTraitor as a North Korean state-sponsored group, active since at least 2020, that steals and launders cryptocurrency to fund the North Korean regime. The cybersecurity industry tracks the group under multiple designations, including Lazarus Group, APT38, and BlueNoroff. The FBI had previously attributed the $1.5 billion Bybit hack in February 2025 to the same group.
What the FBI published and who it targeted
The FBI published a list of 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address linked to the attack. Notably, no Tron addresses appeared on the list despite Tron being the primary laundering chain. The agency urged THORChain's THORNode operators, RPC node operators, instant exchanges, DeFi services, and other providers to block transactions linked to those addresses immediately. Mempool.space data confirmed that all 18,270 BTC remained sitting in the 19 Bitcoin addresses on the FBI's list as of publication.
THORChain technical co-founder Chad Barraford responded on Saturday evening, confirming that THORNode operators had no information beyond what was already publicly available on-chain. He did not state whether node operators would comply with the FBI's block request. An unrelated Ethereum reorg on Saturday had already triggered an emergency pause on THORChain after a double-refund of a 10 ETH deposit. That pause incidentally halted trading on 10 of the protocol's 13 connected chains, including Tron, Ethereum, and Bitcoin, meaning the hackers were temporarily locked out alongside all other users. Trading from Tron had been halted since approximately midday Saturday and remained halted as of Sunday afternoon.
The Mechanics of the Operation
Blockchain analytics firm Elliptic provided some of the clearest structural analysis of how the laundering was executed. The hackers' main Tron distribution wallet paid out every hour for 31 consecutive hours, never pausing for longer than 46 minutes. The same swap amounts recurred repeatedly across THORChain deposits, with one specific amount appearing 19 times. When a bridge rejected a deposit, automated scripts immediately re-sent the funds from new wallets to the same destination address.
Elliptic co-founder Tom Robinson concluded that the activity does not appear to involve AI agents. He described the pattern as "repetitive and static: the same sizes, the same rhythm, the same routes, hour after hour," and attributed it to human operators using scripts for the repetitive execution layer. Test transactions and round-number top-ups pointed to human decision-making sitting above the automation. This is a meaningful distinction for compliance teams assessing the threat model: the sophistication lies in the preparation and the volume, not in novel AI-driven obfuscation.
In the Bybit hack in February 2025, Elliptic noted that laundering followed patterns consistent with human working hours. The Binance operation shows no such rhythm, with continuous round-the-clock execution.
Stablecoin freezing and the limits of issuer intervention
Elliptic verified $2.85 billion of the stolen funds as either frozen or seized, representing about 44% of the $6.43 billion it counts as stolen. Of that frozen amount, 94% consists of stablecoins. The asymmetry is stark: no funds have been frozen on Bitcoin, the XRP Ledger, Solana, or NEAR. Approximately $3.25 billion, including 18,327 BTC and 233 million XRP, sits in assets where no central issuer has freeze capability. Chainalysis separately reported that the hackers had been depositing stablecoins into DeFi protocols on Tron in exchange for depository receipt tokens, which cannot be frozen by an issuer, a deliberate step to exit the reach of stablecoin issuers.
AML Compliance Implications for Firms and Practitioners
The Binance laundering operation crystallises several compliance obligations that DeFi-adjacent businesses and their accounting advisers need to act on now.
OFAC and FinCEN obligations
The FBI advisory, issued with Treasury, triggers immediate screening obligations for any U.S. person or U.S.-nexus business. The 628 addresses published by the FBI are a de facto sanctioned-address list for operational purposes, even before any formal OFAC designation update. Any firm whose infrastructure, including swap routers, bridge smart contracts, or custodial wallets, has processed transactions from or to those addresses should review its Suspicious Activity Report (SAR) obligations under the Bank Secrecy Act. Failure to file where there are reasonable grounds to suspect proceeds of crime, including from a designated state-sponsored group, is itself a federal offence.
Symbiosis's public admission that its screening has "gaps" for "fast-moving, sophisticated attempts" is a candid acknowledgement that many DeFi protocols were not built with BSA-grade transaction monitoring in mind. For compliance teams advising DeFi platforms or crypto-native businesses that interact with those protocols, that admission is a material risk indicator. Any business with exposure to Symbiosis, Relay, THORChain, or Chainflip flows during the 48-hour laundering window should conduct a retrospective review against the FBI address list without delay.
Accounting and recordkeeping considerations
For accounting firms and CFOs running crypto-asset books, the first question is whether any balance sheet positions, counterparty receivables, or custodied assets have a provenance link to the laundering chain. With robust crypto accounting software that ingests on-chain transaction data, firms can trace inflows against the FBI's published address list and produce an audit trail documenting that the review was conducted and its outcome. That documentation matters: in the event of a regulatory inquiry, demonstrating proactive screening is the difference between cooperation and culpability.
For any business that received funds that can now be traced to the attacker addresses, even through intermediate hops, there is a recognition question. Those assets may need to be treated as subject to a legal hold or constructive trust rather than freely disposable, pending legal advice. Under ASC 350 or IAS 38, an asset whose title is legally contested cannot simply be carried at fair value without disclosure.
DeFi protocol due diligence
The FBI's direct appeal to node operators, rather than to a regulated intermediary, reflects the decentralised structure of THORChain. But that structure does not insulate node operators from liability analysis. The U.S. Treasury's 2023 DeFi Illicit Finance Risk Assessment identified DeFi protocols as a priority money-laundering vector. Node operators who are U.S. persons and who continue to process transactions from FBI-listed addresses after a public advisory may face exposure under the International Emergency Economic Powers Act, depending on whether Treasury formalises the address list into an OFAC designation.
Firms that use THORChain, Relay, Chainflip, or similar cross-chain routing in their products or client workflows should review their terms of service, their own OFAC compliance programmes, and whether the protocol's governance structure creates any nexus with a U.S. person that brings the whole protocol within U.S. jurisdiction. This is live legal territory, and the FBI's Saturday advisory makes clear the agency is watching.
The broader pattern of DPRK-linked crypto operations is consistent with prior Treasury actions. A review of Treasury sanctions against North Korean IT worker crypto schemes shows that the U.S. government has been methodically expanding its designation framework to cover the full laundering ecosystem, not just the initial theft actors.
What Compliance Teams Should Do This Week
The pace of this operation, $242 million moved in 48 hours across hundreds of wallets, means that retrospective review windows are short before funds are further obfuscated. Practical steps for compliance and accounting teams include the following.
Immediate screening actions
Screen all transaction records against the 628 addresses published by the FBI. If your digital asset accounting software connects directly to on-chain data, run a retroactive match for the past 72 hours and document the output. Any match, direct or one hop removed, should be escalated to your AML officer and legal counsel before any further movement of the affected assets.
Update your internal blocklist to include the FBI's published addresses immediately. Do not wait for a formal OFAC designation update; the advisory from the FBI, Secret Service, and IRS-CI is sufficient grounds for a precautionary freeze pending legal review.
If your business operates or advises a DeFi protocol or cross-chain bridge, assess whether you have U.S.-person exposure among your node operators, developers, or governance token holders. That assessment directly affects whether OFAC's jurisdiction attaches to your protocol's processing of these funds.
Review your SAR filing obligations. Under FinCEN guidance, a SAR must be filed within 30 days of detecting a suspicious transaction, or 60 days if additional time is needed to identify a suspect. The FBI advisory provides reasonable grounds to suspect. The clock is running.
Frequently Asked Questions
Does the FBI advisory create immediate legal obligations for DeFi protocols?
The advisory itself is not a formal OFAC designation, but it is a public warning from law enforcement that specific addresses are linked to a North Korean state-sponsored group. Any U.S. person or business with a U.S. nexus that processes transactions involving those addresses after the advisory was published risks exposure under IEEPA and BSA. Legal counsel should be consulted before any decision to continue processing or to block.
Tether froze a large amount of USDT. Why couldn't that stop the laundering?
Tether can freeze USDT held in wallets it can identify, but the freeze is reactive. By the time it acted, the attackers had already begun moving funds through bridges that convert USDT into non-freezable assets such as ETH, BTC, and TRX. Chainalysis noted the hackers also exchanged stablecoins for depository receipt tokens on Tron-based DeFi protocols, specifically to move beyond the reach of any issuer freeze.
What should a CFO do if their firm received funds that may be one hop from an attacker address?
Stop, document, and get legal advice before moving the assets. Do not treat them as freely disposable. Under U.S. law, knowingly transacting with proceeds of a designated group's theft can trigger civil or criminal liability. The accounting treatment should reflect the legal uncertainty: consider whether a contingent liability disclosure is needed and whether the asset should be segregated pending resolution.
Why did Chainflip fail to block the funds even after blocking the Bybit hackers?
The source reporting indicates that many Chainflip swaps failed for the Binance hack funds, but the failed swaps were automatically refunded to fresh Tron wallets and re-submitted. Chainflip had implemented blocks after Bybit, but the attackers' use of new wallets for each resubmission meant the blocklist was being outpaced by wallet generation. This illustrates a known weakness in address-based blocking: it requires near-real-time list updates to be effective against a well-resourced, automated adversary.
Is this relevant to non-U.S. firms?
Yes. The FATF Travel Rule and local AML laws in the EU, UK, and most APAC jurisdictions require VASPs to screen transactions against sanctions lists and to report suspicious activity. A DPRK attribution by the FBI, combined with existing UN Security Council sanctions on North Korea, creates obligations for regulated entities globally, not just those subject to U.S. jurisdiction. Firms in the EU should also consider their obligations under EU Regulation 2016/1686 and the consolidated DPRK sanctions regime.
Source: The Block