Binance Hack Update: North Korea Launders Proceeds Through Self-Minted Tokens and Chained Bridges

Key takeaways

• About USD 6.4 billion left Binance wallets across ten blockchains on October 29, and the proceeds that were not frozen are now moving through laundering routes not seen in the first week
• On TRON, the attacker created its own token and pool, funded the pool with stolen proceeds, and sold newly minted tokens from a separate wallet, so no transfer links the two sides
• A second TRON method passes value between wallets as a lending receipt token, which hides the link from any trace that follows only USDT
• Bridges have now entered the laundering path, with funds moving from one cross-chain swap straight into a deposit address at a second bridge
• As of November 3, the main Ethereum and Bitcoin balances showed no new relevant activity, while funds were moving on TRON and Solana, so the largest unfrozen holdings remain in place
• Nearly USD 2.7 billion was frozen within hours, and the attacker still holds about USD 2.4 billion in ETH and BTC

{{horizontal-line}}

Bridges and new laundering routes have now appeared in the Binance proceeds

TRM's October 29 analysis of the Binance theft and its October 30 analysis of North Korea's 2026 thefts reported that the proceeds had so far moved through market makers, intent-based contracts, and decentralized exchanges as well as the usual use of bridges. TRM expected bridges, swap services, and over-the-counter brokers to feature in later laundering, and although a significant amount of OTC activity on TRON has already occurred.

Between October 31 and November 2, 2026, TRM investigators traced the first of those movements mainly to TRON and Ethereum. Three methods stand out: a token the attacker created and minted itself, a lending receipt token that moves value between wallets, and cross-chain swaps chained so that no intermediate wallet appears. Each separates the wallet that receives stolen funds from the wallet that cashes them out.

A self-minted token on TRON turned a liquidity pool into a laundering route

On November 1, TRM investigators identified a laundering method on TRON that avoids direct transfers between the attacker's wallets. On October 31, an address already in the Binance trace created a token that only its creator can mint. The token's only market is a single liquidity pool on a TRON decentralized exchange, paired with a lending protocol's receipt token.

The method has three steps:

• Fund the pool. Fresh buyer wallets receive TRX from a fan-out wallet in the hack trace, swap it to USDT, convert that to the receipt token, and buy the new token. The purchases fill the pool with value that came from the theft
• Mint for free. The creator mints new tokens at no cost and sends them to a separate seller wallet
• Withdraw. The seller wallet sells the tokens into the pool, takes out the receipt token, and redeems it for USDT

No transfer connects the buyer wallets to the seller wallet. The only link is the pool.

In one example, on November 1, the fan-out wallet sent about 2.94 million TRX to three buyer wallets. The creator minted 300 million tokens to a seller wallet, which sold them the next minute and withdrew nearly USD 100 million receipt tokens. That redeemed for USDT which then moved to TRX. Two other seller wallets withdrew the USD with only a small portion remaining in the pool.

The seller wallet split the TRX across five new wallets. Between 03:22 and 04:26 UTC, those wallets placed 38 orders worth 966,558 USDT through a wallet-embedded swap router into the bridge wallets of the same service. The service does not publish where orders pay out. Matching by amount and timing places 11 of the 38 orders, about USD 290,000, as payouts on Ethereum, where the attacker swapped the funds to ETH. The other 27 orders and the final Ethereum recipient wallets were still being traced.

A lending receipt token carried value between wallets

The second method uses the receipt token of a lending protocol on TRON. TRM investigators flagged the pattern on November 2:

• Wallet A deposits USDT into the lending pool and receives a receipt token that represents a claim on the deposit
• Wallet A sends the receipt token to wallet B in an ordinary token transfer
• Wallet B redeems the receipt token, and the pool pays wallet B in USDT
• Wallet B sends the USDT to a cross-chain bridge to leave TRON

A trace that follows only USDT sees wallet A send USDT to the lending pool and wallet B receive USDT from the lending pool. The pool is large and shared, so no direct USDT link connects A to B. Wallet B's only counterparties are the lending pool and the bridge, and it looks clean. The connection appears only when the receipt token transfer from A to B is followed.

Chained cross-chain swaps remove the intermediate wallet

Two cross-chain patterns have recurred. First, the attacker has made two swaps in sequence, moving funds from a laundering address directly into a deposit address at the second bridge. That removes the intermediate wallet where an alert or a freeze would normally land.

Second, the TRON branch has repeatedly crossed to Ethereum through the same wallet-embedded swap service. In one traced case, funds from several TRON addresses arrived at intermediary Ethereum addresses, consolidated at a single address, and were forwarded to a second. That address split the funds into chunks of 50 to 80 ETH and sent them to addresses where the ETH remains parked. In a second batch of swaps, all 20 outputs consolidated into two post-swap addresses and then into the same second address. TRM investigators describe the sequence of cross-chain swap, consolidation, and redistribution as typical of North Korean laundering.

Most of the funds remain parked while TRON and Solana moves

As of November 3, TRM's tracing showed no new activity on the attacker's main Ethereum and Bitcoin balances. Funds bridged from Avalanche to Ethereum had not moved. Part of the other token holdings had been bridged to Ethereum and Bitcoin and were sitting at addresses TRM had flagged. TRON was the branch with active movement, and funds also began moving through a series of wallets on Solana.

What compliance and security teams can do

• Follow value through receipt tokens and pool tokens. In the TRON examples, the link between wallets exists only in the receipt token transfer or in the pool
• Screen several hops downstream, including cross-chain swap payouts. Bridge and swap services now appear in the Binance proceeds, and some payouts can be matched only by amount and timing
• Screen against labeled addresses. Run deposits and counterparties against TRM's North Korea labels and rescreen as new attributions are added
• Join real-time alerting. Freezes depend on how fast an issuer or exchange learns an address is tainted, and the TRM Beacon Network delivers alerts to members
• To screen for North Korea exposure and trace stolen funds across chains, request a TRM demo

{{horizontal-line}}

Frequently Asked Questions (FAQs)

1. How much was stolen from Binance, and how much has been frozen?

About USD 6.36 billion left Binance wallets across ten blockchains on October 29, 2026. Tether, Circle, Ripple, World Liberty Financial, and the Arbitrum Security Council froze nearly USD 2.7 billion.

2. How is North Korea laundering the Binance proceeds?

TRM investigators have traced many laundering strategies. Three examples of these methods on TRON and Ethereum include: a self-minted token and liquidity pool, a lending receipt token passed between wallets, and cross-chain swaps chained through two bridges.

3. What is a cross-chain swap?

A cross-chain swap moves value from one blockchain to another through a bridge or swap service, so the funds that arrive come from a different transaction than the funds that left. In the Binance proceeds, the attacker has chained two swaps by sending funds from a laundering address directly to a deposit address at the second bridge.

4. What is a liquidity pool, and how was one used to launder funds?

A liquidity pool is a smart contract that holds two tokens so users can swap one for the other. The attacker created a token and a pool, filled the pool with stolen funds through buyer wallets, then minted new tokens to a separate wallet and sold them into the pool. About USD 2.7 million had been withdrawn from one such pool as of November 1.

5. What is a receipt token?

A receipt token is issued by a lending protocol when a user deposits an asset, and it represents a claim on that deposit. Whoever holds it can redeem the deposit. In the Binance proceeds, one wallet deposited USDT into a lending protocol and a second wallet redeemed the receipt token, so a USDT-only trace shows no link between the two.

6. Who is behind the Binance hack?

TRM attributes the theft to TraderTraitor, a North Korean state-sponsored unit, with high confidence based on onchain and offchain intelligence. Binance has not published a root cause, and no government has attributed the theft.

7. Where are the remaining funds?

As of 07:30 UTC on November 2, 2026, the attacker's main Ethereum and Bitcoin balances showed no new activity, and TRON was the branch with active movement. These positions change as the funds move.