On-chain tracing data shows the attacker behind the reported $6.3 billion Binance theft had moved about $242 million through the TRON network by 21:27 on Nov. 1, using cross-chain bridges, decentralized swap services and hundreds of small transfers to shift value toward Ethereum and Bitcoin.
The activity began after Tether froze $378.7 million of USDT linked to the suspected theft on the first day, according to the tracking data. The freeze limited the attacker's ability to move stablecoins directly, but left substantial TRX and other assets available for conversion and bridging. More than $3 billion in suspected stolen holdings on other networks was described as largely unmoved at the time of the snapshot.
TRON became an early laundering route because it held a large share of the assets associated with the attacker. Tracking data identified $612.7 million in USDT and $46.4 million in TRX in wallets tied to the operation. After the USDT freeze, the attacker appeared to turn to services that could exchange TRX or remaining stablecoins for assets on other chains.
Around $194 million moved through cross-chain protocols, with Relay Protocol, THORChain, Chainflip and Symbiosis handling the largest portions. The routes produced thousands of deposits, many of them relatively small, spreading funds across Ethereum addresses and, in some cases, into Bitcoin.
Funds shift from TRON to Ethereum and Bitcoin
Most bridged value ultimately reached Ethereum mainnet, where trackers recorded roughly 53,300 ETH, alongside residual USDT and USDC balances. Another 68.8 BTC was transferred to the Bitcoin network.
The movement places cross-chain liquidity providers at the center of the response to large-scale crypto thefts. Unlike centralized exchanges, which can freeze identified wallets or block withdrawals, decentralized bridge and swap protocols often execute transactions automatically once users submit funds. That can give an attacker a way to exchange an identifiable asset for a different token or move it to a new network, though every transaction remains visible on public blockchains.
THORChain handled the largest single flow from TRON. The tracker recorded 185.1 million TRX and 3.83 million USDT deposited through 2,697 transactions. Those deposits produced outflows of 17,019 ETH sent to 170 Ethereum addresses and 53.25 BTC distributed to 20 Bitcoin addresses.
THORChain-related transfers also generated 268,928 USDT and 90,025 USDC on Ethereum, 2.41 ETH on Base and 8.01 ZEC. About 46.87 million TRX and 339,000 USDT later returned to TRON wallets associated with the attacker before moving through other routes.
The volume came at a material cost. Tracking data estimated that $48.3 million was swapped through THORChain, while about $42.7 million was received on the other side, leaving roughly $5.7 million lost to fees and price slippage. Front-end interfaces associated with those swaps collected about 145,800 RUNE, valued at approximately $95,000 in the supplied data.
Relay and Chainflip handled large transfers
Relay Protocol ranked second among the routes traced from TRON. The attacker sent 37.64 million USDT and 39.28 million TRX through 735 deposits, receiving 14,656 ETH across 52 addresses and 9.66 million USDT divided among 12 Ethereum addresses.
Relay-linked activity also included 4.41 million USDC sent to 43 accounts on perpetual futures platform Lighter. The data showed those funds subsequently leaving the accounts. A single Ethereum address received 2,804 ETH and 1.02 million USDT through 97 transactions, illustrating how repeated transfers can consolidate value after it has been dispersed through a bridge.
Chainflip processed 49.71 million USDT in 571 deposits, though the route produced a more chaotic record. About 17.91 million USDT was returned after failed conversions, often to newly created TRON wallets that then attempted additional deposits. Successful swaps delivered 13,174 ETH to 196 Ethereum addresses, 415,604 USDT to Ethereum and 14.94 BTC to two Bitcoin addresses.
Symbiosis, the fourth-largest route, received 49.71 million TRX across 1,367 transfers. It delivered 6,846 ETH to 402 Ethereum addresses, 130,129 USDC on Ethereum and 14.45 ETH to Arbitrum. Twenty-eight failed deposits totaling 1.04 million TRX led to 336,000 USDT being returned to wallets linked to the attacker.
Smaller routes complicate the tracing picture
The data identified roughly $43 million routed through wallet and swapping services, including about $41.7 million through Bitget Wallet functions. The final destinations for those transfers were not included in the tracing dataset.
Other activity included $5.69 million in USDT sent through USDT0, with $5.50 million converted into USDT0 and bridged to Ethereum. A further 33,500 USDT0 reached Arbitrum. Across Protocol moved 4.63 million USDT, resulting in 1,615 ETH and 991,000 USDC on Ethereum, while Bridgers and NEAR Intents handled smaller amounts.
About $26 million was lost during the overall process through fees, slippage and token price movements, according to the tracking data. The cost indicates that speed and separation from the original wallets appeared to take priority over preserving the full value of the stolen assets.
Roughly $26 million remained on TRON, including $12 million deposited in JustLend and $5.2 million converted from USDT into USDD. The tracker also associated $4.2 million with HitBTC-linked accounts, $1.4 million with Gate-linked accounts and $432,000 with ChangeHero-linked activity. By the reporting cutoff, about $7.5 million was still held directly on TRON wallets.
The Federal Bureau of Investigation has attributed the theft to TraderTraitor, a North Korean state-backed hacking group. The group has also been linked by U.S. authorities to major cryptocurrency thefts, including the February 2025 Bybit breach.
The remaining holdings attributed to the attacker were substantial: more than 18,270 BTC, about 519,000 ETH, 233 million XRP and 970,000 SOL, worth over $3 billion under the supplied estimates. Their limited movement so far means the TRON activity represents an early but closely watched test of how quickly stolen funds can be converted across networks before issuers, bridges and service operators can intervene.
Concerned about massive hacks and fund tracing? Strengthen your defenses with this essential crypto security guide today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
