Binance hacker shifts $242 million through Tron as billions in stolen funds sit idle
Security & Exploits ·
An on-chain analyst reports the attacker behind a Binance exploit moved roughly $242 million through Tron-related paths within about two days, while more than $3 billion in other stolen assets remain largely untouched on different chains.
The movement follows a theft of roughly $628 million in assets on Tron, according to figures cited by on-chain analyst SomaXBT and relayed in a report. Tether froze about 378.7 million USDT tied to the incident, prompting the attacker to reroute remaining funds through a mix of channels including Relay, THORChain, Chainflip and Symbiosis. An additional roughly $41.7 million passed through Bitget Wallet, with its final destination still unconfirmed, and about $7.5 million remains on Tron.
The scale of the freeze appears to have reshaped the attacker's options rather than halted them. By spreading transfers across several cross-chain bridges and swap services, the attacker has sought paths that avoid the kind of centralized intervention Tether was able to execute on USDT. Despite this activity, the bulk of the haul — more than $3 billion held on other chains — has not moved, suggesting the attacker may be waiting out scrutiny before attempting further laundering.
A separate account of the same funds attributes the laundering effort to North Korean hackers, according to The Block, which reports that the FBI has pressed THORChain to block addresses identified as linked to the attack. That detail adds a law-enforcement dimension to the on-chain tracking, though it has not been independently confirmed in the figures published alongside the transfer totals.
Unresolved questions include the final destination of the $41.7 million routed through Bitget Wallet, whether THORChain or other bridges named in the transfers will act on requests to block flagged addresses, and what triggers, if any, might prompt movement of the more than $3 billion still sitting untouched. Tracking of the remaining Tron balance and any further freezes by Tether will likely shape how much of the stolen total the attacker can ultimately convert.