The attackers who hacked Binance moved about $242 million through the Tron blockchain in just two days and laundered it, distributing the money across cross-chain bridges and thousands of new addresses. For the exchange and its clients, this is a serious risk: the further the funds travel, the harder they are to freeze, and the services through which the stolen millions passed may face claims from regulators.
Based on an analysis of blockchain transactions, more than $3 billion of what remains with the hackers after the freezes is still sitting virtually idle. Token issuers and exchanges still have time to block it. For investors, this money is a hidden threat: if the attackers start selling thousands of stolen BTC and hundreds of thousands of ETH, downward pressure on the prices of leading cryptocurrencies could intensify.
How the stolen funds left Tron
On October 29, hackers stole about $6.36 billion from Binance across ten blockchains. Of that, $628 million was in the Tron network (612.7 million USDT and 46.4 million TRX). A detailed investigation tracked 12,137 wallets belonging to the attackers and more than 56,000 transactions.
Tether froze 378.7 million USDT on the very first day, and about $249 million remained at the attackers' disposal. They immediately sent most of this money to bridges — services for transferring assets between blockchains.
About $194 million left the Tron network through bridges, while roughly $26 million the attackers left inside the network: in the JustLend lending protocol, in swaps for the USDD stablecoin, and in service accounts at the exchanges HitBTC and Gate. Another roughly $22 million was lost by the hackers to fees, slippage, and exchange-rate fluctuations.
Most of the withdrawn money settled in the Ethereum network — about 53,300 ETH. In addition, the attackers received 68.8 BTC, about 15.9 million USDT and 1.2 million USDC on Ethereum, as well as 4.41 million USDC on the Lighter decentralized perpetual futures exchange, from which all funds have already been withdrawn.
Which services the money passed through
The THORChain protocol became the main route for withdrawal: the attackers sent 185.1 million TRX and 3.83 million USDT into it in 2,697 transfers. On the way out, they received 17,019 ETH to 170 addresses on the Ethereum network and 53.25 BTC. During the exchange, the attackers lost about 12%, or $5.7 million, of roughly $48.3 million. The owners of third-party interfaces through which the swaps were routed received about 145,800 RUNE (roughly $95,000) in affiliate rewards.
The Relay protocol took second place. The transfers went almost without pause: the largest recipient on Ethereum received 2,804 ETH and 1.02 million USDT in 97 payments, and from a single wallet on Tron it received about 100,000 USDT almost every minute.
Through Chainflip, the stolen funds moved more chaotically: the attackers sent 49.47 million USDT there, but many swaps failed. The funds were returned to new wallets on Tron, and the hackers relaunched the swap, so 17.91 million USDT passed through the protocol a second time, some amounts several times. The attackers split up amounts in Symbiosis: they sent 49.71 million TRX there in 1,367 small deposits, and distributed the resulting 6,846 ETH across 402 addresses.
The main open question is the fate of about $41.7 million that passed through Bitget Wallet: data on the recipient remained with the service, and where the money went is still unknown. Another 158,500 USDT got stuck in the USDT0 bridge and is most likely frozen.
What will happen to the remaining $3 billion
According to the latest data, only about $7.5 million still remains in the Tron network, while the withdrawn funds continue to move across the Ethereum and Bitcoin networks. The hackers have not touched more than $3 billion in other networks, including 18,270 BTC, about 519,000 ETH, 233 million XRP, and 970,000 SOL. Token issuers have frozen or seized a total of $2.82 billion, and the Arbitrum Security Council returned $32.02 million.
The Tron case shows how important speed of reaction is: the 378.7 million USDT that Tether blocked on the first day remained out of the hackers' reach, while money that has passed through bridges is far harder to recover. After an exchange, the stolen funds scatter across hundreds of addresses in different networks, and tracking them becomes noticeably more difficult.
For cross-chain protocols, this story carries reputational and regulatory risk: hundreds of millions of dollars in stolen funds passed through their infrastructure, and the owners of some interfaces even earned on it. Investors should also take into account the hackers' untouched reserves: if the attackers start converting them into stablecoins or fiat, additional supply may appear on the market.
What this means for Binance clients and the market
Tracking the stolen assets also affects the timeline for compensation: to pay out the money, Binance needs to establish the real extent of the damage and verify the movement of funds across different networks. The exchange promised to cover user losses from the SAFU insurance fund and its own reserves, but the actual reimbursement may stretch over days and weeks.
Market sentiment depends on how Binance handles the aftermath. There is no similarity to FTX, since the exchange lost money in a hack rather than misappropriating client funds. However, BTC holders should watch the level around $76,000 — the average purchase price for those who bought coins one to three months ago: with new withdrawal delays at Binance, this mark could turn from a support into a barrier to growth.
Cryptalist analysis: The situation demonstrates the structural vulnerability of cross-chain infrastructure: bridges and swap protocols have effectively turned into channels for laundering large volumes without effective containment mechanisms. The untouched $3 billion reserve remains a potential source of supply pressure, and the market will price this risk in until the asset is fully frozen or realized. Binance's ability to carry out transparent and rapid compensation will become a key factor in restoring trust in centralized platforms.