- Analyst SomaXBT reported ~$242M from the Binance hack was laundered via Tron in two days
- Tether froze 378.7M USDT on Tron, but hackers moved $249M of accessible funds
- Routes used: Relay ($48M), THORChain ($44M), Chainflip ($32.1M) & Bitget Wallet ($41.7M)
- THORChain halted trading on 10 of 13 connected chains following FBI pressure to block listed addresses
- Elliptic verified ~44% ($2.85B) of the total $6.43B stolen has been frozen or seized
Movement Routes & Scale
Onchain analyst SomaXBT reported that North Korean-linked hackers laundered approximately $242 million from Binance hack proceeds via Tron in a two-day window after the October 29 attack.
1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone, out of the $3.5 billion they still controlled after the freezes.
Here is the full analysis of the laundering from my tracing 🧵 https://t.co/QvawpJ7re5
— SomaXBT (@somaxbt) November 1, 2026
Tether froze 378.7 million USDT on Tron, but roughly $249 million remained accessible to the attackers. Of the $242 million that moved, approximately $194 million left Tron through cross-chain bridges.
Relay handled about $48 million, THORChain $44 million, Chainflip $32.1 million, and Bitget Wallet $41.7 million, with the final destination of the Bitget portion still unresolved.
Tether Freeze & Seizure Progress
Elliptic verified approximately $2.85 billion, roughly 44% of the $6.43 billion total, has been frozen or seized across all platforms. Elliptic co-founder Tom Robinson described the activity as operators making decisions with scripts handling repetitive work, adding it does not appear to involve AI agents.
Chainalysis identified hackers depositing stablecoins into Tron DeFi protocols including JustLend to receive receipt tokens not subject to freezing. TRM Labs noted 300 million USDT moved to a wallet supplying funds to JustLend. About 18,270 BTC remain in the FBI-listed Bitcoin addresses.
Platform Responses & FBI Pressure
The FBI urged THORNode operators, instant exchanges, DeFi services, and RPC node operators to block transactions linked to 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address it published. THORChain halted trading on 10 of its 13 connected chains, including Tron, following an Ethereum reorg that caused a double refund.
Symbiosis acknowledged gaps in its screening mechanisms. Relay confirmed it screens addresses but Specter reported hackers bridged $38 million through it in seven hours. Elliptic noted the main Tron distribution wallet sent funds on an automated hourly schedule for 31 consecutive hours.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment