{"id":33401,"date":"2026-11-01T19:29:34","date_gmt":"2026-11-01T19:29:34","guid":{"rendered":"https:\/\/investx.fr\/en\/2026\/11\/01\/north-korean-hackers-242-million-laundered-tron-binance-hack\/"},"modified":"2026-11-01T19:29:39","modified_gmt":"2026-11-01T19:29:39","slug":"north-korean-hackers-242-million-laundered-tron-binance-hack","status":"publish","type":"post","link":"https:\/\/investx.fr\/en\/crypto-news\/north-korean-hackers-242-million-laundered-tron-binance-hack\/","title":{"rendered":"North Korean Hackers Laundered $242 Million Through Tron After Binance Hack"},"content":{"rendered":"\n

Hackers linked to North Korea<\/strong> successfully routed $242 million<\/strong> in stolen funds through the Tron<\/strong> network. The FBI<\/strong> is now turning up the heat on THORChain<\/strong>, one of the protocols used in this large-scale laundering operation<\/strong>.<\/p>\n\n\n\n

Behind this case lies a sophisticated laundering infrastructure<\/strong> involving multiple DeFi bridges<\/strong> and an unprecedented level of coordination between malicious actors. Here is what the on-chain data reveals.<\/p>\n\n\n\n

A specialist blockchain cybersecurity<\/strong> analyst has traced the entire flow of funds \u2014 and the findings are striking.<\/p>\n\n\n\n

Tron as a Laundering Highway: How the Funds Moved<\/h2>\n\n\n\n

According to analysis published by The Block<\/strong>, North Korean hackers \u2014 most likely affiliated with the Lazarus Group<\/strong> \u2014 funneled $242 million<\/strong> in stolen cryptocurrency from a hack tied to Binance<\/strong> through the Tron<\/a> blockchain. This network was favored for its transaction speed, near-zero fees, and the relative opacity of certain fund flows across its addresses.<\/p>\n\n\n\n

Once the funds were converted and deposited onto Tron<\/strong>, the hackers leveraged several decentralized bridges<\/strong> to extract and disperse them. Approximately $140 million<\/strong> moved through the Relay<\/strong>, THORChain<\/strong>, Chainflip<\/strong>, and Symbiosis<\/strong> protocols. Relay<\/strong> emerged as the primary vector, processing $48 million<\/strong> on its own \u2014 accounting for more than a third of all funds moved through these bridges.<\/p>\n\n\n\n

This pattern is nothing new for the Lazarus Group<\/strong>: the use of cross-chain bridges<\/strong> to fragment and obscure on-chain trails has become their operational signature. The combination of Tron and DeFi bridges<\/strong> allows them to multiply hops across blockchains, making tracing exponentially more complex for authorities.<\/p>\n\n\n\n

FBI Targets THORChain: DeFi Under Regulatory Pressure<\/h2>\n\n\n\n

THORChain’s involvement in this laundering flow triggered a direct response from the FBI<\/strong>. The federal bureau reportedly contacted members of the protocol to obtain information on suspicious transactions, according to data cited by the analyst. THORChain<\/strong>, which enables native cross-chain swaps without a centralized intermediary, once again finds itself in regulators’ crosshairs.<\/p>\n\n\n\n

This is not the first time THORChain<\/strong> has been linked to large-scale laundering operations<\/strong>. The protocol had already been identified in connection with the laundering of funds from the Bybit hack<\/a> in 2025. The recurrence of these incidents raises a structural question: can non-KYC decentralized bridges<\/strong> coexist with international compliance requirements without deep reforms to their governance?<\/p>\n\n\n\n

Chainflip<\/strong> and Symbiosis<\/strong>, two other protocols cited in the analysis, face the same scrutiny. The FBI<\/strong>‘s pressure on these DeFi infrastructures<\/strong> marks a turning point: authorities are no longer content with monitoring \u2014 they are now engaging directly with development teams and validators.<\/p>\n\n\n\n

A Binance Hack at the Heart of a State-Sponsored Operation<\/h2>\n\n\n\n

The funds at the origin of this laundering scheme are believed to stem from a hack targeting assets tied to the Binance ecosystem<\/a>. While the precise details of the initial attack vector remain partially unclear, the scale of the amount \u2014 $242 million<\/strong> \u2014 places this incident among the most significant crypto cybercrime<\/strong> cases of the year.<\/p>\n\n\n\n

The Lazarus Group<\/strong>, widely regarded as North Korea’s cyber warfare arm<\/strong>, is regularly identified by the FBI<\/strong>, OFAC<\/strong>, and blockchain analytics firms such as Chainalysis<\/strong> and Elliptic<\/strong> as the primary actor behind the most sophisticated crypto hacks<\/strong>. These operations directly fund North Korea’s weapons program<\/strong>, according to repeated findings from US and UN intelligence agencies.<\/p>\n\n\n\n

For the DeFi community, this episode is a stark reminder that protocol neutrality carries both a reputational and potentially legal cost. Cross-chain bridges<\/strong>, designed to maximize interoperability, are increasingly becoming tools of choice for malicious state actors \u2014 a challenge that neither decentralized governance nor smart contracts alone can resolve.<\/p>\n\n\n\n

\n\n\n\n

Related articles :<\/h3>\n\n\n\n