2 hours ago
24
Funds tied to the record October 29 breach are on the move again, and TRX is proving much harder to claw back than stablecoins
A wallet holding stolen funds from the Binance hack has moved 120 million TRX to an unknown address, according to on-chain tracker Whale Alert.
What moved, and where it came from
By October 30, blockchain forensic firms had flagged specific Tron addresses controlled by the attackers, each holding exactly 120 million TRX.
Another wallet in the same cluster reportedly held about 158.2 million TRX. Smaller transfers kept trickling out of other addresses linked to the group after the attack.
Investigators describe those smaller movements as consistent with peel-chain transfers. Each slice is small enough to look unremarkable. Together, they make the original sum harder to follow and easier to cash out in pieces.
The breach behind the money
The original attack hit Binance on October 29, 2026. Roughly $6.3 billion in digital assets was drained from the exchange’s hot wallets across about ten blockchains.
The whole thing took around 20 minutes.
Tron was one of the hardest-hit networks. Attackers pulled 612.7 million USDT and 46.4 million TRX out of Binance’s hot wallets on that chain.
The attackers used SunSwap, a decentralized exchange on Tron, to trade around 234 million USDT for an estimated 638 million TRX.
That swap matters more than it might first appear. USDT is a stablecoin issued by Tether, and Tether can freeze tokens sitting in specific addresses. TRX, Tron’s native token, has no central issuer with a freeze button. The research findings note that non-freezable assets like TRX continue to pose a challenge for recovery efforts.
Tether and Circle froze approximately $2.7 billion to $3 billion in stablecoins in the aftermath of the attack.
Who is behind it, and how Binance responded
The incident has been attributed with high confidence to TraderTraitor, a North Korean hacking group linked to previous large-scale exploits.
Binance is investigating a compromised DevOps laptop as the potential initial attack vector.
The exchange said it would cover all losses for affected customers. It temporarily suspended withdrawals from impacted wallets and set aside more than $6.34 billion in company funds to absorb the damage.
Significant portions of the stolen assets, particularly the TRX, remain in the hackers’ hands. The research findings describe the attackers as actively laundering the funds.
What this means
The bigger story is the split between what can and cannot be recovered. Stablecoins proved partly recoverable because their issuers can freeze them, and billions were locked within days. Native tokens like TRX play by different rules. Once they leave an exchange’s control, recovery depends on tracing, cooperation from other platforms, and catching the money when it tries to exit.
The research findings point to increased scrutiny of centralized exchange security and the possibility of stricter protocols across the industry.
The findings suggest some traders may weigh a shift toward decentralized exchanges after this breach. The attackers used a decentralized exchange, SunSwap, to move their money into a harder-to-freeze form.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
English (US) ·