North Korean-linked actors (TraderTraitor) have laundered approximately $242 million through the Tron leg alone within two days exploit. This is a fraction of the ~$6.3–6.4B total theft (largest crypto heist on record), of which ~$2.8–3B was frozen on-chain by issuers (Tether, Circle, etc.) and protocols. Roughly $3.5B remained controllable by the attackers after freezes; the Tron activity represents early, rapid layering.⁠ Tron flow breakdown: Stolen on Tron: ~$628M (612.7M USDT + 46.4M TRX). Tether froze 378.7M USDT on day 1 → ~$249M left movable. ~$194M exited via bridges/swaps: Relay ~$48M, THORChain ~$44M, Chainflip ~$32.1M, Symbiosis ~$16M (plus smaller routes like USDT0, Across). Additional ~$43M via Bitget Wallet and others (destinations partly unresolved). ~$26M stayed on Tron (JustLend, USDD swaps, CEX service accounts); ~$22M lost to fees/slippage. Bridged funds primarily landed as ETH on Ethereum mainnet (~53k ETH), BTC, and stablecoins, then continued moving. ~$7.5M still on Tron; $3B+ on other chains (BTC, ETH, XRP, SOL) remains largely untouched.⁠ FBI, USSS, and IRS-CI have attributed the full hack to DPRK’s TraderTraitor and explicitly urged THORChain node operators, RPC providers, instant exchanges, and DeFi services to block addresses tied to the proceeds. Laundering shows high automation and volume (thousands of deposits), shifting toward bridges and instant swaps rather than solely mixers. Bridges remain high-throughput exit vectors even under scrutiny; decentralized designs face clear tension between permissionless operation and law-enforcement pressure. Most capital is still staged, so the next wave of movement will be the key tracking phase.