TRON Channeled Millions in Stolen Binance Funds Before CEX Freezes

Elliptic Traces Stolen Funds Across TRON

TRON served as a major early route for moving assets stolen in the Binance hack, according to a November 2 investigation report published by Elliptic. Blockchain analytics data showed the attackers spreading funds across roughly 7,700 TRON addresses before activity shifted to alternative layer-one networks.

Elliptic estimated that about $3.24B in digital assets remained sitting at addresses associated with the theft at around 07:00 UTC on November 2. Binance reported approximately $6.3B stolen in the October 29 attack. The FBI subsequently attributed the multi-billion dollar breach to North Korea's TraderTraitor group.

SunSwap Swaps Trigger Tether Freeze

According to Elliptic data, the hackers swapped 234M stolen USDT for TRX on SunSwap just before Tether froze the remaining USDT supply on TRON. A distribution wallet began breaking TRX into smaller chunk transfers on October 30. Funds travelled through thousands of different addresses and crossover bridges.

In total, $147M left the TRON network, almost all of which arrived on the Ethereum network as ETH. A total time of 51 hours elapsed across 1,113 distinct transfers from the time the distributing wallet came into service to its final transaction on November 1.

Fund Flows Pivot to Ethereum and Bitcoin

By early November 1, TRON network activity had largely stopped, according to Elliptic monitoring. Movement picked up rapidly on Ethereum, Solana, and other networks as the actors divided the capital. Early on November 2, all 233M stolen XRP moved to six newly created addresses.

Elliptic also identified about 28 BTC passing through coin-mixing transactions that combined multiple users' Bitcoin to obscure the audit trail. Only a tiny amount was cashed out, meaning exchanges and brokers still retain opportunities to intercept the tainted capital.