North Korean Hackers Push Binance Stolen Funds Through Tron Bridges as Pressure Builds on THORChain

Onchain analysts says the attackers moved about $242 million of the stolen money on Tron within two days. They had roughly $249 million left to move after Tether froze 378.7 million USDT from the $628 million taken on that network. About $194 million left Tron through bridges and swap services, $26 million stayed put, and around $22 million went to fees and slippage.

Which Bridges Handled the Funds

Relay took the biggest share at $48 million, followed by THORChain with $44 million, Chainflip with $32.1 million and Symbiosis with $16 million. Bitget Wallet handled another $41.7 million, though its final destination is unclear. Symbiosis admitted its screening has gaps and said it is closing them.

FBI Alert and THORChain Response

The FBI blamed the TraderTraitor group and urged THORNode operators and other providers to block linked addresses. Its list covers 608 Ethereum, 19 bitcoin and one Solana address, but none on Tron. THORChain co-founder Chad Barraford said node operators hold no private information but did not say whether they would block the addresses. Swaps remained halted on 10 of 13 connected chains.

Automation and Frozen Assets

Elliptic says the pattern looks like scripts run by human operators, not AI agents. It verified $2.85 billion as frozen or seized, about 44% of the stolen total, while $3.25 billion sits in assets no issuer can freeze.