A wallet containing stolen funds from the Binance hack has transferred 120 million TRX to an unknown address, according to on-chain tracker Whale Alert. The movement underscores ongoing difficulties in recovering native tokens from the record breach.
The October 29 Attack
On October 29, 2026, attackers drained approximately $6.3 billion in digital assets from Binance's hot wallets across roughly ten blockchains in around 20 minutes. The Tron network was among the hardest hit, with attackers removing 612.7 million USDT and 46.4 million TRX from the exchange.
Converting to Harder-to-Freeze Assets
Attackers used SunSwap, a decentralized exchange on Tron, to convert approximately 234 million USDT into an estimated 638 million TRX. This conversion proved significant because USDT is a stablecoin that Tether can freeze at specific addresses, while TRX has no central issuer capable of doing so.
By October 30, blockchain forensic firms had identified addresses controlled by the attackers, each holding exactly 120 million TRX. Another wallet in the same cluster reportedly held about 158.2 million TRX, with smaller transfers continuing from other linked addresses.
Recovery Challenges
Tether and Circle froze approximately $2.7 billion to $3 billion in stablecoins following the attack. However, non-freezable assets like TRX continue to present recovery obstacles. Investigators described smaller outgoing transfers as consistent with peel-chain movements, where individual transactions remain unremarkable while collectively making the original sum harder to trace and easier to cash out in pieces.
Attribution and Response
The incident has been attributed with high confidence to TraderTraitor, a North Korean hacking group linked to previous large-scale exploits. Binance is investigating a compromised DevOps laptop as the potential initial attack vector. The exchange said it would cover all losses for affected customers and set aside more than $6.34 billion in company funds to absorb the damage.
Significant portions of stolen assets, particularly TRX, remain in the hackers' hands, with researchers describing the attackers as actively laundering the funds.
