SomaXBT: North Korean hackers laundered about $242 million in stolen Binance funds within two days
On-chain analyst and Security Alliance (SEAL) contributor SomaXBT said that two days have passed since the Binance theft, and the attackers (the laundering team) have already laundered about $242 million through the Tron leg alone, part of the roughly $3.5 billion they still controlled after the freezes.
SomaXBT said that about $628 million was stolen on Tron, including $612.7 million in USDT and 46.4 million TRX. Tether froze $378.7 million in USDT on the first day, leaving about $249 million in remaining funds the attackers could move. Of that, about $194 million flowed out of Tron through cross-chain bridges and swapping services: Relay processed about $48 million, THORChain about $44 million, Chainflip about $32.1 million, and Symbiosis about $16 million, totaling about $140 million. Another roughly $43 million flowed out through channels including Bitget Wallet, with the destinations not yet fully clear. About $26 million remained on Tron. About $22 million was lost to fees, slippage, and price volatility. Most of the cross-chain funds ultimately landed on Ethereum mainnet, at about 53,300 ETH, as well as on Bitcoin and other chains.
Meanwhile, the U.S. Federal Bureau of Investigation (FBI) issued an alert on October 31, attributing the theft of more than $6 billion in virtual assets from Binance around October 29 to North Korea's TraderTraitor activity, and jointly urged THORNode operators, RPC node operators, instant exchange services, DeFi services, and other virtual asset service providers, together with the U.S. Secret Service and the IRS Criminal Investigation division, to block transactions associated with the listed addresses or their derived addresses.
Original sources:
Title: 1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone... Publisher: SomaXBT (@somaxbt) Publication date: 2026-11-01 URL: https://x.com/somaxbt/status/2116884703655723207 Source nature: direct post by the party involved Verification: full thread read in this release (items 1–9), verification date 2026-11-01 Supporting content: about $242 million laundered through the Tron leg within two days; the scale of the Tron theft, the amount of USDT frozen by Tether, and the remaining movable funds; specific outflow amounts via Relay/THORChain/Chainflip/Symbiosis and the total of about $140 million; other channels, amounts remaining on Tron, and losses; final main destinations.
ABAB AI Insight
SomaXBT is an on-chain threat investigator and an intelligence contributor to Security Alliance (SEAL). He has been continuously tracking the fund flows in this Binance incident, focusing on breaking down the laundering path on Tron. The FBI has formally attributed the overall incident, in which more than $6 billion was stolen around October 29, to North Korea's TraderTraitor, and has named THORNode operators and others to help block related transactions, consistent with earlier attributions in cases such as Bybit.
From the fund path perspective, after the initial theft of about $628 million on Tron, Tether quickly froze most of the USDT, and the attackers shifted to native TRX and other paths that cannot be directly frozen by a stablecoin issuer. Cross-chain bridges became the main exit route: Relay, THORChain, Chainflip, and Symbiosis together handled about $140 million in outflows. These services themselves are decentralized or semi-decentralized, and node operators can independently decide whether to filter addresses, so the FBI's call requires voluntary execution by each node rather than a mandatory order. SomaXBT's tracking shows that most funds ultimately entered Ethereum and Bitcoin addresses, and some destinations, such as channels related to Bitget Wallet, still await further analysis.
Compared with the 2025 Bybit incident, which was also attributed to TraderTraitor and was worth about $1.5 billion, this laundering relied more on multiple bridges operating in parallel and high-frequency small deposits to reduce the risk of a single interception point. Relay played a larger role than in previous TraderTraitor cases, showing that the attackers dynamically adjust based on available channels. As one of the largest single exits, THORChain's response to the FBI request will become a key point to watch.
For trackers, the $242 million outflow over two days is only a partial development on the Tron leg; the attackers still control billions of dollars in unmoved assets on other chains. The final destination depends on whether nodes cooperate with freezes, whether cross-chain services can continue to track the funds, and subsequent secondary dispersion on Ethereum and Bitcoin. The key indicators are whether named services such as THORChain publicly respond to the FBI address list, and how the proportion of