North Korean hackers move about $242 million of Binance loot off Tron in two days as Elliptic counts $2.85 billion frozen or seized

The Tron side of the Binance theft has largely been drained. SomaXBT, an on-chain analyst who contributes to the Security Alliance (SEAL), said the North Korean hackers moved about $242 million of the stolen funds off Tron in two days, The Block reported on Sunday, November 1.

The attackers took about $628 million from Binance on Tron, and Tether froze 378.7 million USDT, leaving about $249 million to move. About $194 million left through bridges and swap services, including Relay with $48 million, THORChain with $44 million, Chainflip with $32.1 million and Symbiosis with $16 million, while $41.7 million went through Bitget Wallet to an unresolved destination. The FBI's list of addresses to block covers 608 on Ethereum, 19 on Bitcoin and one on Solana, but none on Tron. Symbiosis said it detected attempts to route funds tied to the incident and is working with Binance, PANews reported.

Blockchain analytics firm Elliptic said the main Tron distribution wallet paid out every hour for 31 hours straight. Its co-founder Tom Robinson said the activity did not appear to involve AI agents. Elliptic has verified $2.85 billion as frozen or seized, about 44% of the $6.43 billion it counts as stolen, according to The Block. Binance, which reopened withdrawals on Sunday, has said users will bear none of the loss, TheStreet reported.