Binance hack left more than $3 billion untouched as attacker shifts funds through Tron, DeFi and bridges

More than $3 billion in cryptocurrency stolen in the Binance hack remains largely untouched, even after the attacker moved parts of the haul through cross-chain bridges, DeFi protocols, and intermediary wallets. For PSPs and exchanges, the useful detail is not the headline number; it is that most of the funds still sit in attacker-controlled wallets, while the laundering routes are already mapped.

1. According to on-chain analyst SomaXBT, the attacker moved approximately $242 million through Tron-related channels within two days of the hack. SomaXBT’s November 1 transaction map tracks more than 12,000 attacker wallets and shows funds moving through THORChain, Relay, Chainflip, Symbiosis, JustLend and Bitget Wallet Swap Bridge.
2. The Tron (TRX) portion of the attack initially involved approximately $628 million in stolen assets. Tether froze about $378.7 million in USDT, which pushed the attacker toward alternative routes for the remaining funds. Around $41.7 million was also routed through Bitget Wallet, although its final destination had not been established in SomaXBT’s update, and about $7.5 million remained on Tron.
3. Bitquery’s October 31 investigation found that approximately $3.1 billion in stolen cryptocurrency remained in the attacker’s wallets, mostly on Ethereum (ETH) and Bitcoin (BTC). Several addresses showed no outgoing transactions, and there was no evidence that the funds had reached centralized exchange deposit addresses or cryptocurrency mixers.
4. The FBI attributed the hack to North Korea’s TraderTraitor cybercrime group, which it linked to more than $6 billion in cryptocurrency thefts. In its October 31 alert, the agency warned that the attackers could continue laundering the funds through DeFi protocols and instant swap services, and urged THORChain node operators, cryptocurrency exchanges, and blockchain infrastructure providers to block transactions linked to the identified wallets.
5. Chainalysis also identified a laundering technique involving stolen stablecoins deposited into Tron-based DeFi protocols in exchange for receipt tokens that cannot be frozen. Those tokens can later be redeemed through new wallets, which makes recovery harder. JustLend was identified as the likely protocol involved.

Binance said it had replenished approximately 95% of the affected assets by November 1 using its corporate treasury, Secure Asset Fund for Users (SAFU), and futures insurance fund. The remaining 5% consisted mainly of less-liquid tokens that took longer to source. The exchange began restoring withdrawals in phases on November 1, with services resuming across all 15 networks and assets included in the first phase by 12:36 UTC. In the first nine and a half hours after withdrawals resumed, Binance recorded approximately $4.65 billion in withdrawals against $1.01 billion in deposits, resulting in net outflows of $3.64 billion.