Binance Hacker Launders $242M in 48 Hours via Tron Bridges, $3B Still Untouched
TREE NEWS reports: Three days after the $6.3 billion Binance exploit, the attacker’s money-laundering team has already washed approximately $242 million through the Tron network alone. Despite Tether freezing $378.7 million USDT, the attacker still controls over $3 billion in stolen assets across multiple chains, with the bulk remaining unmoved.
Tron Outflows: Bridges Dominate
The attacker stole $628 million on Tron (including $612.7 million USDT and $46.4 million TRX). After Tether’s freeze, about $249 million in TRX remained under attacker control and was rapidly dispersed. The funds split into three main routes:
- Cross-chain bridges: $194 million, with Relay ($48M), THORChain ($44M), Chainflip ($32.1M), Symbiosis ($16M), USDT0 ($5.5M), and Across ($4.7M) handling the bulk.
- Bitget Wallet and other services: $43 million, of which Bitget Wallet accounted for $41.7 million; final destinations for much of this remain unconfirmed.
- Remaining on Tron: $26 million, including $12M in JustLend, $5.2M swapped from USDT to USDD, and deposits to HitBTC ($4.2M) and Gate ($1.4M).
Most bridged funds ultimately landed on Ethereum mainnet (about 53,300 ETH), with smaller amounts to Bitcoin (68.8 BTC), Arbitrum, and Base.
Bridge-by-Bridge Breakdown
THORChain emerged as the largest single channel: 2,697 deposits of 185.1 million TRX and 3.83 million USDT yielded 17,019 ETH, 53.25 BTC, and stablecoins, with about 12% lost to fees and slippage. Relay Protocol, previously little used in TraderTraitor cases, became the second-largest route, processing 735 deposits to output 14,656 ETH, $9.66 million USDT, and $4.41 million USDC sent to perpetual DEX Lighter. Chainflip saw chaotic retries—$17.91 million in failed swaps were repeatedly resent—before 13,174 ETH and 14.94 BTC were successfully bridged. Symbiosis used a scattergun approach with 1,367 small deposits to move 49.71 million TRX into 6,846 ETH across 402 addresses.
What’s Next?
As of press time, about $7.5 million remains on Tron, while bridged funds continue to move across Ethereum and Bitcoin. The attacker still holds over $3 billion on other chains—including 18,270 BTC, 519,000 ETH, 233 million XRP, and 970,000 SOL—that has largely not been touched. The scale of untouched assets suggests a patient, sophisticated operation that may be waiting for market conditions or regulatory attention to shift. For exchanges and bridge operators, the case underscores the need for real-time monitoring and cross-chain cooperation, as launderers increasingly exploit decentralized infrastructure to obscure trails.
