How much of the Binance hack's stolen funds has been recovered?

Binance said in the days after the October 29, 2026 disclosure that it had frozen roughly $3 billion of the approximately $6.3 billion taken, largely by working with other exchanges and blockchain partners to flag affected wallets. But freezing funds on centralized platforms gets harder once money leaves for decentralized protocols like THORChain, where there's no company account to freeze. On-chain analysts tracking the hackers' wallets estimated that at least $242 million had already moved through the Tron network within about 48 hours of the theft, on top of a separate reported tranche moving toward Solana and being converted into Bitcoin — so the recovered share is likely to keep shrinking as laundering continues.

What is THORChain, and why do hackers keep using it to launder stolen crypto?

THORChain is a decentralized protocol that lets people swap tokens across different blockchains (for example, Ethereum to Bitcoin) without going through a centralized exchange or identity check. It's run by independently operated computers called nodes rather than a single company. That's useful for ordinary traders who want to avoid KYC paperwork, but it also means there's no central operator who can unilaterally freeze a transaction the way an exchange can freeze an account. Hackers have used it for exactly that reason in both the 2025 Bybit hack and the 2026 Binance hack.

Will the FBI's request actually force THORChain to block the stolen funds?

Not automatically. THORChain isn't a company that answers to a regulator the way Binance or Coinbase does — it's a network of independent node operators who would each have to choose to act. During the Bybit hack, law enforcement made similar requests and THORChain's laundering continued for days before any internal pressure built, and the protocol collected millions in fees along the way. Whether node operators coordinate to block Binance-hack-linked addresses this time is still an open question as of early November 2026.

Does this laundering activity put my own crypto at risk?

Not directly — this is about where already-stolen funds go, not a new vulnerability in your wallet or exchange account. But it's a reminder that decentralized, permissionless infrastructure is a double-edged feature: the same lack of gatekeeping that lets anyone swap tokens freely also makes it harder to claw back stolen money once it moves past a centralized exchange. This is not financial advice, and if you're assessing exchange or protocol risk, treat any laundering-speed figures as moving estimates from on-chain analysts rather than final numbers.

How North Korea Is Laundering the Binance Hack's Stolen Billions Through THORChain

On November 2, 2026, the FBI publicly attributed the record $6.3 billion Binance hack to North Korea’s TraderTraitor hacking unit and urged the decentralized swap protocol THORChain to block wallet addresses tied to the stolen funds, according to CryptoSlate and NPR. The request came too late to stop a lot of movement: on-chain analysts estimated that roughly $242 million of the stolen money had already moved through the Tron blockchain within about 48 hours of the theft, per The Block.

This isn’t a new problem. It’s close to a repeat of what happened after the $1.4 billion Bybit hack in February 2025 — same alleged attacker, same laundering rail, same basic standoff between law enforcement and a protocol that has no central company to compel. Here’s what’s actually happening with the money, how the laundering mechanics work, and why a government request to “just block it” is harder to execute than it sounds.

What did the FBI actually say?

The FBI’s November 2 statement moved the Binance hack’s attribution from private-sector analysis to an official government position. In the days right after Binance disclosed the breach on October 29, blockchain intelligence firms TRM Labs and Chainalysis had already pointed to North Korea’s TraderTraitor group with “high confidence,” but the FBI itself hadn’t weighed in, and Binance’s own spokesperson would only say the company was “working closely with law enforcement partners” (TRM Labs).

By November 2, that changed. The FBI formally blamed North Korea and, notably, went further than a simple attribution statement: it publicly called on THORChain to block addresses connected to the theft, according to CryptoSlate’s reporting. That’s an unusual ask, because THORChain isn’t a company the FBI can serve a warrant to — a point worth unpacking, since it explains why these requests rarely work cleanly.

How did $242 million move through Tron in two days?

According to an on-chain analyst cited by The Block, wallets linked to the Binance theft moved an estimated $242 million through the Tron network in roughly two days — a pace that mirrors how quickly stolen funds moved after the Bybit hack. CoinCentral’s coverage of the same tracking effort likewise frames THORChain as one of the cross-chain services drawing the FBI’s attention, alongside other swap and bridge services that let funds hop between blockchains without passing through a centralized, KYC-checking exchange.

The mechanics are straightforward even if the dollar figures are large: stolen funds get split across many wallets, moved onto a blockchain like Tron that processes transactions cheaply and quickly, then run through decentralized swap protocols that convert one token into another — Ethereum into Bitcoin, for instance — without any single company ever taking custody or asking who’s behind the trade. Each hop makes the money harder to trace back to the original theft, and each one happens faster than any law-enforcement freeze request can keep up with.

A second wave: Solana, then back to Bitcoin

Days after the Tron-based movement, blockchain trackers reported a separate tranche of funds shifting toward Solana and being converted into Bitcoin. Seoul Economic Daily reported on November 3 that the hackers had begun emptying wallets where stolen funds had been temporarily parked and moving them onto networks including Solana, with roughly $89 million tied to that specific stage of movement. That figure describes one tranche being tracked, not the full total laundered so far — on-chain estimates for an active laundering operation shift as analysts pick up new wallet clusters, so treat any single dollar figure as a moving estimate rather than a final count.

What is THORChain, and why can’t it just block the money?

THORChain is a decentralized protocol for swapping tokens across different blockchains — Bitcoin to Ethereum, Ethereum to Solana, and so on — without routing the trade through a centralized exchange. There’s no THORChain Inc. with a compliance department and a bank account regulators can freeze. Instead, the network runs on independently operated computers called nodes, which collectively process swaps according to the protocol’s code. No sign-up, no identity check, no customer-service line.

That design is exactly what makes it attractive to both ordinary traders who don’t want to hand over ID to swap tokens, and to hackers who need to move stolen funds across chains without leaving a centralized paper trail.

	Centralized exchange (e.g. Binance, Coinbase)	Decentralized protocol (e.g. THORChain)
Who holds your funds	The exchange, in its own wallets	You, until the swap executes peer-to-peer
Identity checks	Required (KYC)	None
Can a single party freeze a transaction?	Yes — the company can freeze an account	No — would require node operators to coordinate
Who a subpoena targets	The company	No single legal entity exists
Precedent for hack-related laundering	Can freeze stolen funds quickly if flagged	Processed large shares of the 2025 Bybit laundering

A government request to “block the funds” works cleanly against a centralized exchange, which is exactly how Binance itself froze roughly $3 billion of the stolen assets within its own systems. Against a decentralized protocol, the same request depends on a scattered group of node operators choosing, individually, to act — which is a coordination problem, not a compliance order.

This is the Bybit playbook, replayed

The Binance hack isn’t the first time this exact dynamic has played out. After North Korea’s Lazarus Group (also tracked under the TraderTraitor umbrella) stole roughly $1.4–1.5 billion in ETH from Bybit in February 2025, THORChain became the primary route for laundering it. Lookonchain’s tracking showed that by February 28, 2025 — a week after the theft — the hackers had already moved about 270,000 ETH (roughly $605 million, about 54% of the stolen total) largely through THORChain, converting it toward Bitcoin. By March 1, the laundered share had climbed to around 68% of the total stolen.

Blockchain analytics firm Arkham estimated that at least $240 million of the Bybit haul moved specifically through THORChain, with the two primary non-custodial routes being THORChain and a service called eXch, according to The Block’s reporting at the time. THORChain itself earned an estimated $5.5 million in swap fees from processing that laundering volume, per ITC.ua — money the protocol’s node operators collected regardless of where the swapped funds had come from. The episode also triggered friction inside the project itself: a THORChain developer resigned over how the protocol handled the laundering controversy, according to Forklog.

That history is why the FBI’s November 2026 request to THORChain reads less like a fresh ask and more like round two of a fight law enforcement already lost once. Nothing about the protocol’s structure has changed since 2025 — it’s still run by distributed node operators with no central company to compel — so there’s no obvious mechanism that would make this request succeed where the last one didn’t.

Does this affect you if you don’t use Binance or THORChain?

Not directly. This is a story about where already-stolen money goes after a breach, not a new security hole in your own wallet or exchange account. But it’s worth understanding if you hold crypto on any platform, for two reasons. First, it’s a preview of how fast and how far stolen funds can move once they leave a centralized exchange — which is part of why exchanges increasingly share wallet-tagging data with each other to try to freeze assets before they reach a decentralized bridge. Second, it’s a live example of the tradeoff built into permissionless DeFi: the same lack of gatekeeping that lets you swap tokens without handing over your ID is what makes laundering this hard to stop. Regulators are likely to keep citing cases like this as justification for pushing more compliance requirements onto bridges and cross-chain protocols — which is itself a dynamic worth watching if you use DeFi regularly.

None of this is financial advice, and the dollar figures above are analyst estimates from a still-unfolding investigation — treat specific numbers as directional rather than final, and expect them to be revised as more wallets are traced. For the fuller rundown of what Binance itself has said about the breach, including what happened on the day of the hack and what’s being done to make affected users whole, see our earlier explainer on the Binance hack. And for context on how often incidents like this happen, September 2026’s record month for crypto hacks shows this kind of breach-and-launder cycle isn’t rare — just usually smaller.