Hackers linked to North Korea successfully routed $242 million in stolen funds through the Tron network. The FBI is now turning up the heat on THORChain, one of the protocols used in this large-scale laundering operation.
Behind this case lies a sophisticated laundering infrastructure involving multiple DeFi bridges and an unprecedented level of coordination between malicious actors. Here is what the on-chain data reveals.
A specialist blockchain cybersecurity analyst has traced the entire flow of funds — and the findings are striking.
Tron as a Laundering Highway: How the Funds Moved
According to analysis published by The Block, North Korean hackers — most likely affiliated with the Lazarus Group — funneled $242 million in stolen cryptocurrency from a hack tied to Binance through the Tron blockchain. This network was favored for its transaction speed, near-zero fees, and the relative opacity of certain fund flows across its addresses.
Once the funds were converted and deposited onto Tron, the hackers leveraged several decentralized bridges to extract and disperse them. Approximately $140 million moved through the Relay, THORChain, Chainflip, and Symbiosis protocols. Relay emerged as the primary vector, processing $48 million on its own — accounting for more than a third of all funds moved through these bridges.
This pattern is nothing new for the Lazarus Group: the use of cross-chain bridges to fragment and obscure on-chain trails has become their operational signature. The combination of Tron and DeFi bridges allows them to multiply hops across blockchains, making tracing exponentially more complex for authorities.
FBI Targets THORChain: DeFi Under Regulatory Pressure
THORChain’s involvement in this laundering flow triggered a direct response from the FBI. The federal bureau reportedly contacted members of the protocol to obtain information on suspicious transactions, according to data cited by the analyst. THORChain, which enables native cross-chain swaps without a centralized intermediary, once again finds itself in regulators’ crosshairs.
This is not the first time THORChain has been linked to large-scale laundering operations. The protocol had already been identified in connection with the laundering of funds from the Bybit hack in 2025. The recurrence of these incidents raises a structural question: can non-KYC decentralized bridges coexist with international compliance requirements without deep reforms to their governance?
Chainflip and Symbiosis, two other protocols cited in the analysis, face the same scrutiny. The FBI‘s pressure on these DeFi infrastructures marks a turning point: authorities are no longer content with monitoring — they are now engaging directly with development teams and validators.
A Binance Hack at the Heart of a State-Sponsored Operation
The funds at the origin of this laundering scheme are believed to stem from a hack targeting assets tied to the Binance ecosystem. While the precise details of the initial attack vector remain partially unclear, the scale of the amount — $242 million — places this incident among the most significant crypto cybercrime cases of the year.
The Lazarus Group, widely regarded as North Korea’s cyber warfare arm, is regularly identified by the FBI, OFAC, and blockchain analytics firms such as Chainalysis and Elliptic as the primary actor behind the most sophisticated crypto hacks. These operations directly fund North Korea’s weapons program, according to repeated findings from US and UN intelligence agencies.
For the DeFi community, this episode is a stark reminder that protocol neutrality carries both a reputational and potentially legal cost. Cross-chain bridges, designed to maximize interoperability, are increasingly becoming tools of choice for malicious state actors — a challenge that neither decentralized governance nor smart contracts alone can resolve.
