Four major crypto bridges transferred roughly $140 million in stolen Binance funds off the Tron network, dispersing loot from the exchange breach across multiple chains. Relay handled the largest share at $48 million, while THORChain, Chainflip, and Symbiosis moved the remainder.
The movement is part of a broader laundering operation. North Korean hackers have pushed $242 million of the stolen assets through Tron, according to blockchain intelligence cited by The Block. The FBI has pressed THORChain specifically, though the nature of that pressure isn’t detailed in available reports.
Bridge Mechanics, Not Bridge Failures
These aren’t exploits. The bridges functioned as designed, cross-chain swap infrastructure that doesn’t discriminate between clean capital and dirty money. Relay, THORChain, Chainflip, and Symbiosis all offer permissionless routing. A hacker with stolen USDT on Tron can swap it into ETH on Ethereum or BTC on a sidechain without touching a centralized exchange order book. No KYC. No compliance checkpoint. Just liquidity pools and automated market makers doing what they’re built to do.
Relay’s $48 million tranche is notable. The protocol bills itself as a fast cross-chain bridge aggregator, pulling liquidity from multiple sources to execute large swaps with minimal slippage. That makes it appealing for anyone moving serious size in a hurry. THORChain, the second-largest conduit here, has faced scrutiny before, its native cross-chain swaps between Bitcoin, Ethereum, and other L1s have made it a favorite tool for mixers and sanctions-adjacent flows. Chainflip and Symbiosis are smaller but serve the same function: decentralized rails that route value across chains without a chokepoint.
Tron as the Staging Ground
Tron’s role as the initial staging ground is consistent with past patterns. USDT on Tron offers low fees and high liquidity, and the network has become a go-to for moving stablecoin proceeds from hacks and scams. Once funds hit Tron, bridging them to Ethereum, BNB Chain, or Bitcoin-adjacent networks fragments the trail. Investigators can track the bridges, but once assets are atomized across wallets and chains, the operational cost of tracing every hop climbs fast.
The Binance breach itself remains under investigation. The $242 million figure represents only the portion routed through Tron so far, total losses haven’t been confirmed, and it’s unclear whether additional funds remain on the exchange’s native BNB Chain or other networks. What’s clear: the hackers didn’t wait. They moved fast, split the loot, and leaned on decentralized infrastructure that, by design, can’t say no.
