Attackers responsible for the October 29 Binance security breach moved approximately $242 million through the Tron blockchain and associated cross-chain services within two days of the incident, according to on-chain investigator SomaXBT.
The transfers represent part of the estimated $6.3 billion stolen from Binance-controlled wallets, rather than an additional theft.
The activity comes as blockchain intelligence firms continue tracking billions of dollars in cryptocurrency that remain under attacker control. Tether has frozen approximately $378.7 million in USDT associated with the attack, limiting movement of those tokens on Tron.
However, substantial amounts of cryptocurrency remain outside the reach of centralized issuer-level freezes. Blockchain analytics firm Elliptic estimated that approximately $3.25 billion in stolen assets lacked such freezing mechanisms as of its latest assessment.
The investigation highlights the challenges of recovering cryptocurrency once attackers begin moving funds across multiple networks and decentralized financial protocols.
Tron Transfers Routed Through Multiple Cross-Chain Services
SomaXBT identified several protocols involved in transferring assets away from Tron, including THORChain, Relay, Chainflip and Symbiosis. THORChain processed approximately $48.3 million in swaps, with recipients receiving around $42.7 million after transaction costs and slippage.
Relay handled roughly $37.6 million in USDT transfers alongside additional TRX movements, distributing proceeds across Ethereum and other networks. Chainflip received approximately $49.47 million in USDT through hundreds of transactions.
Some transfers failed, resulting in approximately $17.91 million being refunded and subsequently routed through alternative addresses. Symbiosis received approximately 49.71 million TRX across more than 1,300 smaller deposits. Investigators also identified approximately $41.7 million passing through infrastructure associated with Bitget Wallet, although the ultimate destination remains uncertain.
These figures reflect activity observed across different services and may include repeated movement of the same funds. Consequently, they cannot be added together to calculate a separate total loss. Elliptic reported that the attackers’ main Tron distribution wallet executed transactions every hour for 31 consecutive hours.
The regular timing suggests that automated scripts were used to coordinate transfers. However, Elliptic co-founder Tom Robinson said the observed activity appeared consistent with human-directed operations supported by automation, rather than evidence of independently acting artificial intelligence agents.
Asset Freezes Leave Billions Beyond Immediate Recovery
Elliptic estimated that approximately $2.85 billion in stolen cryptocurrency had been frozen or seized, representing around 44% of its estimated $6.43 billion incident total. Most restricted assets were stablecoins, including USDT and USDC, whose issuers can prevent transfers from designated addresses.
The firm identified approximately $3.25 billion in assets without equivalent centralized freezing mechanisms, including Bitcoin and XRP. As of its November 1 assessment, roughly 18,270 BTC remained in 19 Bitcoin addresses identified by the FBI.
However, investigators subsequently observed approximately 233.46 million XRP, valued near $293 million, moving into six additional wallets. The XRP transfers demonstrate that previously inactive balances can move as attackers reorganize their holdings. They also underline the importance of treating blockchain intelligence estimates as time-specific observations.
US authorities have attributed the Binance attack to North Korea’s TraderTraitor hacking operation. Binance has pledged to reimburse affected customers using corporate resources and emergency reserves while coordinating recovery efforts with law enforcement and blockchain security companies.
The exchange has also resumed withdrawals following security checks, although the incident continues to affect confidence in centralized cryptocurrency custody. The movement of stolen assets through decentralized protocols complicates recovery because funds can be converted and redistributed without relying on a single intermediary.
For investigators, tracing destination addresses and coordinating restrictions with exchanges and service providers remain central priorities. While approximately $242 million has already moved through Tron-linked routes, billions of dollars in other stolen assets remain under observation.
The eventual financial loss will depend on how much can be frozen, recovered or replaced by Binance.