Binance Hackers Created a Token to Trade With Themselves
North Korea’s hackers are moving Binance proceeds through a self-minted token and lending receipts, so no direct transfer links the wallets that receive and cash out funds.
Key Takeaways
- The attackers traded the new token with themselves.
- Lending receipts hid the link from USDT traces.
- TRM matched 11 of 38 bridge orders.
- Freezes need a wallet to land on.
TRM Labs described the routes in a November 3 update covering October 31 to November 2, the period when bridges and new TRON methods first appeared in its trace.
About $6.36 billion left Binance wallets across ten blockchains on October 29, according to TRM. The FBI attributed the theft to North Korea on October 31, naming the activity TraderTraitor, the same designation it used for the $1.5 billion Bybit theft in February 2025.
Issuers and networks moved quickly. Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze nearly $2.7 billion within hours. TRM estimates the attacker still holds about $2.4 billion in ETH and BTC, and those main balances showed no new activity as of November 3. The movement TRM is following is on TRON, with funds also starting to pass through a series of Solana wallets.
On TRON, each new method solves the same problem for the attacker: a freeze or an alert has to point at a specific address.
A token only its creator could mint
On October 31, an address already in the Binance trace created a token that only its creator can mint. Its sole market was a single pool on a TRON decentralized exchange, pairing the token with a lending protocol’s receipt token. TRM does not name either the exchange or the lending protocol.
TRM breaks the route into three steps:
1. Fund
Fresh buyer wallets receive TRX from a fan-out wallet in the hack trace, swap it to USDT, convert that into the receipt token and buy the new token.
2. Mint
The creator mints new tokens at no cost and sends them to a separate seller wallet.
3. Withdraw
The seller sells into the pool, takes out the receipt tokens and redeems them for USDT.
The seller’s tokens cost nothing to create, so everything of value it took from the pool had been put there by the buyer wallets, and those were funded from the hack. TRM found no transfer between the buyers and the seller. The pool is their only connection, so a trace watching wallet-to-wallet payments sees unrelated addresses trading a new token.
In one case on November 1, the fan-out wallet sent about 2.94 million TRX to three buyer wallets. The creator then minted 300 million tokens to a seller wallet, which sold them within a minute, withdrew nearly 100 million receipt tokens, redeemed them for USDT and converted that into TRX.
That 100 million is best read as a count of receipt tokens rather than dollars, because a receipt converts to USDT at a rate set by the lending market. TRM’s dollar figure for one such pool is about $2.7 million withdrawn as of November 1.
The exit to Ethereum is only partly traced
The seller wallet split its TRX across five new wallets. Between 03:22 and 04:26 UTC, those wallets placed 38 orders worth 966,558 USDT through a swap router built into a wallet app, all paying into bridge wallets of the same cross-chain service.
The service does not publish where its orders pay out, so TRM matched them by amount and timing. Eleven of the 38 orders, about $290,000, line up with payouts on Ethereum, where the funds were swapped into ETH. That accounts for roughly 30% of the batch by value. TRM was still tracing the other 27 orders, and the Ethereum wallets that finally received the funds, when it published.
A match on amount and timing is an inference, not a record from the service itself. It gives investigators specific Ethereum addresses to examine, while leaving most of this batch unplaced.
In another traced case on the same TRON-to-Ethereum route, funds from several TRON addresses arrived at intermediary Ethereum addresses. They were then consolidated, forwarded to a second address and split into chunks of 50 to 80 ETH. That ETH has stayed where it landed. TRM describes this sequence of swapping, consolidating and redistributing as typical of North Korean laundering.
A deposit claim passed between wallets
TRM flagged the second TRON method on November 2. Wallet A deposits USDT into a lending pool and receives a receipt token representing its claim on that deposit. It sends the receipt to wallet B in an ordinary token transfer. Wallet B redeems it, the pool pays out USDT, and B sends that USDT to a bridge off TRON.
A trace that follows only USDT breaks at the pool. A sends USDT in, and B takes USDT out. Because the pool is large and shared with many other depositors, nothing in the USDT flows ties the two together. B’s only counterparties are the lending market and a bridge, so its history looks clean. The link exists only in the receipt token transfer from A to B.
The receipt carries the deposit itself, not a copy of it. If A deposits $100,000 and hands over the receipt, B can redeem that deposit under the market’s rules, and A is left with no claim of its own.
This differs from the earlier borrowing of ETH against stolen stablecoins. Borrowing leaves a debt secured by posted collateral. Passing a receipt transfers ownership of the deposit outright.
What a freeze needs to land on
Both TRON routes keep the wallet holding hack-linked funds from ever paying the wallet that cashes out. The bridges add a third version of the same idea. TRM has seen the attacker chain two cross-chain swaps, sending funds from a laundering address straight into a deposit address at a second bridge. That skips the intermediate wallet where, in TRM’s words, an alert or a freeze would normally land.
The $2.7 billion stopped in the first hours was stopped at addresses that issuers knew to be tainted. TRM’s advice to compliance teams follows from what these routes break. It recommends following value through receipt tokens and pool tokens and screening several hops downstream, including cross-chain payouts. It also cautions that some payouts can be matched only by amount and timing. A check that looks only at who sent a USDT deposit would pass wallet B.
The largest balances are still parked. The roughly $2.4 billion in ETH and BTC had not moved as of November 3, while the laundering TRM documented on TRON ran from hundreds of thousands to a few million dollars at a time. The FBI’s call to block TraderTraitor-linked wallets depends on someone identifying those wallets first. Every route described here is designed so the next wallet in line has no visible payment history with the last.
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 5,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
