--- title: "Analyst says North Korean hackers laundered $242 million via Tron as FBI presses THORChain" description: "An analyst cited by The Block said North Korean hackers laundered $242 million of Binance loot through Tron, and that crypto bridges Relay, THORChain,…" language: en canonical: "https://whycoinmoves.com/en/events/thorchain-north-korean-hackers-launder-242-b8e213abbfb4bc" published: 2026-11-01T18:26:01.000Z updated: 2026-11-01T19:28:02.000Z indexable: true --- # Analyst says North Korean hackers laundered $242 million via Tron as FBI presses THORChain An analyst cited by The Block said North Korean hackers laundered $242 million of Binance loot through Tron, and that crypto bridges Relay, THORChain,… Attributed sources: [The Block]() ## Key facts An analyst cited by The Block said North Korean hackers laundered $242 million of Binance loot through Tron, and that crypto bridges Relay, THORChain, Chainflip and Symbiosis moved about $140 million of the stolen funds off Tron, with Relay handling the most at $48 million. The report says the FBI is pressing THORChain. Evidence strength: Single source, 1 publisher group(s) (The Block). After site detection, observed returns were 5 minutes: +0.32% (difference from BTC +0.30 pts; Nov 1, 2026, 18:26 → Nov 1, 2026, 18:31, UTC; Gate · USDT); 1 hour: -2.48% (difference from BTC -2.31 pts; Nov 1, 2026, 18:26 → Nov 1, 2026, 19:26, UTC; Gate · USDT) In the preceding 30 days, the 99th percentile of absolute hourly returns was 4.03% (Gate · USDT; cutoff Nov 1, 2026, 18:26, UTC). ## Returns after site detection | Window | Return | BTC | Difference from BTC | Actual sampled interval (UTC) | Source | | --- | --- | --- | --- | --- | --- | | 5 minutes | +0.32% | +0.02% | +0.30 pts | Nov 1, 2026, 18:26 → Nov 1, 2026, 18:31 | Gate · USDT | | 1 hour | -2.48% | -0.18% | -2.31 pts | Nov 1, 2026, 18:26 → Nov 1, 2026, 19:26 | Gate · USDT | ## Historical hourly baseline | Metric | Value | | --- | --- | | Coverage | 100.0% (720/720) | | Median absolute hourly return | 0.39% | | 99th percentile of absolute hourly returns | 4.03% | | BTC beta | 1.48 | | Source / cutoff (UTC) | Gate · USDT / Nov 1, 2026, 18:26 | ## Claims and open questions - An analyst said North Korean hackers laundered $242 million of Binance loot via Tron, per The Block. - Crypto bridges Relay, THORChain, Chainflip and Symbiosis moved about $140 million of the stolen funds off Tron, with Relay handling the most at $48 million, The Block reported. - The FBI is pressing THORChain, according to The Block's report. - What specific action the FBI has taken toward THORChain, and what THORChain itself has said about the alleged fund flows, would confirm the nature of the pressure described. ## Source evidence - [North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst]() — The Block; published Nov 1, 2026, 18:25; received Nov 1, 2026, 18:26 (UTC). ## Recent RUNE events and market reactions - [RUNE rises after report of Binance record $6.3B hack]() — Published Oct 30, 2026, 09:52 (UTC) · Single source (1 publisher) · Security · Complete reaction windows unavailable - [Full coin archive]() ## Recent Security events on other coins - [TRX: Analyst says North Korean hackers laundered $242 million of Binance loot via Tron]() - [BTC: US spot Bitcoin ETFs post $643.2 million single-day outflow after Binance hack]() - [BTC: Binance begins phased crypto withdrawals, starting with bitcoin, after $6.3 billion hack]() - [Security]() ## Research for this archive - [Does crypto news move prices or follow them? A timestamp audit]() - [Crypto hacks and price impact: Bybit and Cetus case studies]() - [Why is crypto moving? How to check the evidence behind a price explanation]() Evidence levels describe source coverage, not the probability that a report is true. Price moves and their timing cannot establish a cause; minute samples show an observed interval and alert thresholds are heuristics. Explanations are model-assisted, with citations and figures checked. Source titles stay in their original language; full articles are not republished. [Methods and limitations]()