TRON became an early route for stolen Binance funds, Elliptic finds

TRON served as a major early route for moving assets stolen in the Binance hack, according to a November 2 investigation by Elliptic. The blockchain analytics firm traced funds spreading across roughly 7,700 TRON addresses before much of the activity shifted elsewhere.

Elliptic’s summary showed how the attackers moved on some of its assets during and after stablecoin issuers such as Tether froze billions of dollars. Elliptic estimated that about $3.24 billion in digital assets were still sitting at the addresses associated with the theft at around 07:00 UTC on November 2.

Thousands of wallets carried the funds onward

Binance reported approximately $6.3 billion stolen in the October 29 attack. The FBI subsequently attributed the theft to North Korea’s TraderTraitor group.

According to Elliptic’s investigation, the attackers swapped 234 million stolen USDT for TRX on SunSwap before Tether froze the remaining USDT on TRON.

A distribution wallet began breaking TRX into smaller chunk transfers on October 30. The funds travelled through thousands of different addresses and crossover bridges/services that exchange assets. ​

In total, $147M was seen leaving the TRON network, almost all of which left and reached the Ethereum network as ETH.

A total time of 51 hours was used, and a total of 1,113 transfers occurred from the time the distributing wallet came into service to its last transfer. The last transfer took place on 1 November at 05:33 UTC.

What the $242 million estimate covers

In another November 1 thread, analyst SomaXBT calculated that about $242 million was laundered in roughly two days using TRON-linked routes.

Over two-thirds of the amount was allocated to routes leaving TRON (194M versus 194M). An added $22M was an estimated amount of fees, trading costs, and price change.

In both investigations, the money was moved through several services, ending up in newly created wallets, adding another layer of extra steps investigators had to follow.

Activity spreads beyond TRON

By early November 1, TRON activity had largely stopped, Elliptic said. Movement subsequently picked up on Ethereum, Solana, and other networks.

Early on November 2, all 233 million stolen XRP moved to six new addresses. Elliptic also identified about 28 BTC passing through transactions that combine multiple users’ Bitcoin, complicating tracing.

Only a tiny amount was likely cashed out, according to Elliptic, meaning it is still possible for exchanges and brokers to intercept because investigators will be following the assets.

Final Summary

• Elliptic observed these stolen funds through approximately 7,700 TRON addresses until they appeared to migrate to other networks.
• On November 2, Elliptic said it found around $3.24 billion in addresses linked to the theft.