Race against time on Tron. Three days after the $6.3 billion heist, North Korean hackers have already passed $242 million of Binance loot through Justin Sun's network. They also started converting their SOLs into bitcoins. The FBI responded on Saturday with a list of 628 addresses and a directive addressed by name to THORChain node operators. The story of the theft and the attribution to TraderTraitor are in our report of the 9.6 billion stolen by North Korea. Here, we follow the money.
Binance loot laundering: 242 million passed through Tron in 48 hours
Imagine a robber coming out of the bank with bags of marked notes. He must exchange them quickly, before the serial numbers circulate. This is exactly the situation with hackers on Tron. Around $628 million had landed there by October 29, and Tether froze 378.7 million USDT in the process. There were therefore 249 million remaining to be sold. On Sunday, on-chain analyst SomaXBT did the math in a survey relayed by The Block. Result: 242 million dollars have already left the perimeter in two days.
The detail says everything about the method. Indeed, some 194 million came out of Tron through bridges and instant exchange services. These tools convert an asset from one blockchain to another without going through a centralized exchange. Relay absorbed 48 million, THORChain 44 million, Chainflip 32 million and Symbiosis 16 million. Bitget Wallet saw 41.7 million passes, the destination of which has not yet been determined. Twenty-six million are still sleeping on Tron. Finally, 22 million evaporated in fees, slippage and price variations.
Furthermore, the Solana front opened the same day. Lookonchain spotted the start of the conversion of the stolen 970,522 SOL, or $95.9 million, into bitcoin via Relay on Sunday. Half were already being exchanged within the hour. In total, Elliptic estimates the theft at 6.43 billion, including 2.85 billion frozen or seized, from 94% of stablecoins. The rest of the Binance loot weighs in at $3.25 billion, with 18,327 BTC and 233 million XRP. However, no transmitter can block them.
Binance loot: FBI publishes 628 addresses and targets THORChain
On Saturday, the Bureau made official what TRM Labs and Chainalysis had been saying since Thursday. His alert attributes the theft to TraderTraitor. It also publishes 628 addresses to monitor: 608 on Ethereum, 19 on Bitcoin, only one on Solana. No Tron address. Yet this is where money moves the fastest. Next, the FBI asks THORChain nodes, instant exchange services, and DeFi protocols to block any transactions related to this list.
THORChain is not mentioned by chance. The cross-chain exchange protocol had already been used to recycle Bybit's loot in February 2025. It also refused to block the Bitget hack wallets. He has not yet said whether he will obey this time. His co-founder has chosen his side: he publicly opposes any freeze. He invokes the neutrality of a permissionless protocol, reports Cointelegraph in its recap of the week.
THORChain stopped on 10 chains: the bug that slows down pirates despite themselves
Still, chance did some of the work the FBI asked for. On Ethereum, a block reorganization replaced a recent block with a competing block. It caused a double reimbursement in the coffers of THORChain, which paid the same deposit twice. The nodes then suspended trading on 10 of the 13 connected networks. They were still stationary on Sunday according to The Block.
The protocol that refuses to censor pirates therefore cut itself off, at the precise moment when they needed it most. On the other hand, the 44 million Binance loot already passed through THORChain is gone. The rest awaits the reopening, channel by channel, which operators must vote on.
