--- title: 'North Korean Hackers Move $242M in Binance Loot Through Tron, Analyst Says' url: >- https://www.cryptocatalyst.news/articles/2026-11-03-north-korean-hackers-move-242m-in-binance-loot-through-tron-analyst-says canonical: >- https://www.cryptocatalyst.news/articles/2026-11-03-north-korean-hackers-move-242m-in-binance-loot-through-tron-analyst-says date: '2026-11-03T14:03:10.663533+00:00' category: general tags: - north-korea - binance - tron - bridges - laundering source: The Block source_url: >- https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257 sources: - name: The Block url: >- https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257 - name: Decrypt url: >- https://decrypt.co/382355/north-korea-laundering-binance-hack-loot-new-wallet-every-25-seconds publisher: CryptoCatalyst summary: >- An analyst says North Korean hackers moved $242 million in Binance-related stolen funds through Tron. Four bridges shifted about $140 million off the network, with Relay handling $ image: >- https://www.cryptocatalyst.news/images/articles/2026-11-03-north-korean-hackers-move-242m-in-binance-loot-through-tron-analyst-says.webp generated_by: automated editorial pipeline --- # North Korean Hackers Move $242M in Binance Loot Through Tron, Analyst Says An analyst says suspected North Korean hackers moved $242 million in funds stolen from Binance through Tron, using a fast-moving web of wallets. Four bridges then moved about $140 million off Tron, with Relay handling the largest share at $48 million. ## Key takeaways - An analyst said suspected North Korean hackers moved about $242 million in Binance-related stolen funds through Tron. - Relay, THORChain, Chainflip and Symbiosis moved about $140 million off Tron. - Relay handled the largest reported bridge total, at $48 million. - Decrypt reported that the laundering operation used about 12,000 wallets and created one roughly every 25 seconds. - Decrypt reported $2.85 billion of $6.43 billion stolen from Binance had been frozen or seized. Suspected North Korean hackers have moved about $242 million in stolen Binance funds through the Tron blockchain, according to an analyst cited by The Block. The laundering effort used thousands of wallets and several crypto bridges—services that transfer assets between separate blockchains. Relay, THORChain, Chainflip and Symbiosis together moved about $140 million off Tron. Relay handled the largest reported amount, $48 million. Separately, Decrypt reported that the operation was creating a new wallet roughly every 25 seconds and had involved about 12,000 wallets. ## How the bridges moved funds off Tron Relay accounted for roughly a third of the $140 million reported as moved off Tron. The available figures do not explain where all of the $242 million went or how much remains traceable or recoverable. The reports also describe pressure from the FBI on THORChain over its role in processing transactions. That pressure highlights a tension for cross-chain services: they enable ordinary users to move assets between networks, but can also be used to move stolen funds. ## What the recovery numbers mean Decrypt reported that $2.85 billion of $6.43 billion stolen from Binance had been frozen or seized. That is a substantial recovery effort, but the report compares the share frozen or seized with about 3% in the Bybit hack, underscoring how much more has been locked in this case. For users, the practical point is that freezing funds depends on investigators and platforms identifying assets before they are moved or exchanged further. The reported wallet changes every 25 seconds suggest a highly automated process, making rapid coordination important. This case also differs from a straightforward exchange freeze: once funds pass through several bridges, multiple networks and service providers may be involved. Related reporting has examined [other alleged North Korean crypto laundering activity](/articles/2026-07-25-north-korea-arrests-hackers-for-laundering-stolen-bank-funds-via-crypto) and [a separate case involving funds moved on Hyperliquid](/articles/2026-08-31-north-korean-hackers-move-30m-on-hyperliquid-as-trump-eyes-onshoring). The next concrete indicators are whether more funds are frozen or seized and whether the named bridges restrict or disclose additional transactions. The figures in these reports are analyst and media accounts, not confirmation that every wallet or transfer has been conclusively attributed. ## FAQ ### How much Binance-related stolen crypto was moved through Tron? An analyst cited by The Block said suspected North Korean hackers moved about $242 million in stolen Binance funds through Tron. ### Which bridges moved funds off Tron? Relay, THORChain, Chainflip and Symbiosis together moved about $140 million off Tron, according to the report. Relay accounted for $48 million. ### How many wallets were used in the laundering operation? Decrypt reported that the operation spanned about 12,000 wallets, with a new wallet being created roughly every 25 seconds. ## Sources This article synthesizes reporting from [The Block](https://www.theblock.co/news/defi/2026-11-01-north-korean-hackers-launder-242-million-of-binance-loot-via-tron-as-fbi-presses-thorchain-analyst-432257), [Decrypt](https://decrypt.co/382355/north-korea-laundering-binance-hack-loot-new-wallet-every-25-seconds), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy. ## How to cite CryptoCatalyst.news, "North Korean Hackers Move $242M in Binance Loot Through Tron, Analyst Says", 2026-11-03, https://www.cryptocatalyst.news/articles/2026-11-03-north-korean-hackers-move-242m-in-binance-loot-through-tron-analyst-says