The attackers behind the October 29 Binance hack moved 120 million TRX from a compromised wallet to an unknown address on October 30, continuing their efforts to launder $6.3 billion stolen from the exchange.
The 120 million TRX transfer was detected by blockchain forensic firms monitoring the flow of stolen funds. The transaction marked one of several smaller movements designed to avoid detection while the attackers work to convert non-freezable assets into harder-to-trace forms.
The money originated from Binance's October 29 hot wallet compromise, which affected roughly 612.7 million USDT and 46.4 million TRX on the Tron network. Attackers quickly moved the stolen USDT to SunSwap, a decentralized exchange on Tron, where they swapped approximately 234 million USDT for 638 million TRX.
The split occurred around 6:15 a.m. ET on October 30, with four new addresses each receiving 120 million TRX and a fifth receiving 158.2 million TRX. One of the 120 million TRX recipients immediately sent the full amount to an address already in the traced flow, showing the attackers are following established laundering patterns.
Tether and Circle froze approximately $2.7 billion to $3 billion in stablecoins after the breach, but native tokens like TRX present different challenges. Unlike stablecoins issued by centralized entities, TRX has no central issuer with a freeze capability, making recovery dependent on tracing and catching the money when it attempts to exit crypto markets.
The investigation into the October 29 attack has been attributed with high confidence to TraderTraitor, a North Korean hacking group linked to previous large-scale exploits. Binance set aside more than $6.34 billion in company funds to cover all losses and has identified a compromised DevOps laptop as the potential initial attack vector.
The breach took only 20 minutes but exposed critical vulnerabilities in exchange security. Stablecoins proved partially recoverable because their issuers can freeze tokens, but native assets like TRX continue to pose challenges for recovery efforts. The attack has prompted increased scrutiny of centralized exchange security protocols across the industry.
Analysts note that the split between recoverable and non-recoverable assets highlights fundamental differences between stablecoin and native token ecosystems. Once TRX leaves an exchange's control, recovery depends on tracing blockchain transactions and cooperation from other platforms to intercept the money.