Tracking the Binance Hacker's Money Laundering Path: How the Untouched $3 Billion Might Escape
- Core Viewpoint: Within three days of the $6.3 billion Binance theft, the attackers had already laundered approximately $242 million through the Tron network, primarily using cross-chain bridges to move funds to Ethereum and Bitcoin networks, but over $3 billion in stolen funds remains largely untransferred.
- Key Elements:
- The attackers stole a total of $628 million on Tron; after Tether froze 378.7 million USDT, the remaining approximately $249 million was moved through multiple pathways.
- Cross-chain bridges were the primary money laundering channel, involving approximately $194 million, with Relay ($48 million), THORChain ($44 million), and Chainflip ($32.1 million) as the top three pathways.
- THORChain was the largest single channel, with 185.1 million TRX and 3.83 million USDT injected, netting approximately $48.3 million in swaps, with about 12% lost to fees and slippage.
- The Bitget Wallet channel involved approximately $41.7 million and is the primary pathway whose fund destination remains unidentified, with the relevant destinations controlled by that service.
- After cross-chain transfers, most funds flowed into the Ethereum mainnet (approximately 53,300 ETH), with another 68.8 BTC entering the Bitcoin network and a small amount flowing into Arbitrum and Base.
- The attackers still control over $3 billion in assets on other chains (18,270 BTC, approximately 519,000 ETH, 233 million XRP, 970,000 SOL), which have basically not yet been transferred.
Source: On-chain analyst SomaXBT
Compiled by Odaily (@OdailyChina); Translator: Azuma (@azuma_eth)
Three days have passed since the $6.3 billion Binance hack. As of 21:27 on November 1, the attacker (money-laundering team) has already laundered approximately $242 million through a single fund-transfer route on Tron alone. And after the earlier freezing actions, the attacker still controls roughly $3.5 billion in stolen funds.
Below is my complete analysis of the attacker's money-laundering activities based on on-chain tracking.
On-Chain Activity on Tron
The attacker stole a total of $628 million on the Tron network (including 612.7 million USDT and 46.4 million TRX).
On the first day of the incident, Tether froze 378.7 million USDT, leaving approximately $249 million in TRX under the attacker's control, which continued to be moved. Subsequently, these funds were mainly split into three directions.
The first direction was transfers through cross-chain bridges, involving approximately $194 million. Among these, the following routes carried the bulk of the fund transfers:
- Relay: $48 million;
- THORChain: $44 million;
- Chainflip: $32.1 million;
- Symbiosis: $16 million;
- USDT0: $5.5 million;
- Across: $4.7 million.
The second direction was transfers through services such as Bitget Wallet, involving approximately $43 million. Among these, Bitget Wallet accounted for $41.7 million; in addition, there were Bridgers and NEAR Intents. The final destination of the relevant funds remains to be confirmed.
The third direction was funds still remaining on the Tron network, totaling approximately $26 million. The main destinations included:
- JustLend: $12 million;
- USDT swapped to USDD: $5.2 million;
- HitBTC service account: $4.2 million;
- Gate service account: $1.4 million;
- ChangeHero and other smaller services.
The remaining approximately $22 million was lost during the transfer process to fees, slippage, and price fluctuations. Looking at where the funds went after cross-chain transfers, most of the funds ultimately flowed into the Ethereum mainnet, including approximately 53,300 ETH; in addition, about 68.8 BTC was transferred to the Bitcoin network; approximately 15.9 million USDT and 1.2 million USDC remained on Ethereum; 4.41 million USDC was transferred to Lighter; and a small amount of funds flowed into Arbitrum and Base.
The chart below shows the complete flow of the stolen funds on the Tron network after the freeze, including the various cross-chain bridges the funds passed through and the destination chains they ultimately reached.
Escape Route 1: THORChain
THORChain was the largest single channel through which the attacker moved funds from the Tron network. Through 2,697 deposits, the attacker injected 185.1 million TRX and 3.83 million USDT into THORChain.
The funds ultimately withdrawn included:
- 17,019 ETH, dispersed across 170 Ethereum addresses;
- 53.25 BTC, dispersed across 20 Bitcoin addresses;
- 268,928 USDT and 90,025 USDC, transferred to Ethereum;
- 2.41 ETH transferred to Base;
- 8.01 ZEC.
In addition, another 46.87 million TRX and 339,000 USDT were returned to the attacker's Tron wallet and subsequently transferred out through other channels.
On a net basis, the attacker exchanged approximately $48.3 million through THORChain and ultimately received about $42.7 million, with approximately $5.7 million (12%) lost to fees and slippage. The front-end interfaces involved in these exchanges earned approximately 145,800 RUNE (about $95,000) in revenue sharing from the relevant transactions.
The chart below shows which blockchains the funds transferred through THORChain ultimately flowed to, and the corresponding receiving wallets.
Escape Route 2: Relay Protocol
Relay Protocol played a far greater role in this money-laundering operation than before.
In the previous TraderTraitor hacking incidents, Relay was barely involved in laundering stolen funds, but in this incident it became the second-largest channel for the attacker to move funds from the Tron network. Through 735 deposits, the attacker transferred 37.64 million USDT and 39.28 million TRX to Relay.
The funds ultimately received included:
- 14,656 ETH, dispersed across 52 addresses;
- 9.66 million USDT, dispersed across 12 Ethereum addresses;
- 4.41 million USDC, transferred to 43 accounts on the perpetual contract DEX Lighter (these funds have since all been moved out);
- 0.656 BTC, transferred to the Bitcoin network.
The speed of the fund transfers was staggering. The largest receiving address (0xc8D516a53e28909d9eAB92642938762eA36F9093) cumulatively received 2,804 ETH and 1.02 million USDT through 97 transactions, with one Tron wallet sending it approximately 100,000 USDT almost every minute.
In addition, 3.53 million TRX and 1.19 million USDT were returned to the attacker's Tron wallet and subsequently transferred out again.
The chart below shows which blockchains the funds transferred through Relay ultimately flowed to, and the corresponding receiving wallets.
Escape Route 3: Chainflip
Chainflip was the third-largest channel used by the attacker, and also the most chaotic path in the entire process.
Through 571 deposits, the attacker transferred 49.71 million USDT to Chainflip, but a considerable portion of the swap transactions failed. After each failed transaction, the funds were returned to a newly created Tron wallet, and the attacker would then immediately transfer the money back into Chainflip to attempt the swap again.
A cumulative 17.91 million USDT was returned due to failed transactions and re-initiated for transfer, with some funds even being retried several times.
The funds ultimately successfully transferred out included:
- 13,174 ETH, dispersed across 196 Ethereum addresses;
- 415,604 USDT, transferred to Ethereum;
- 14.94 BTC, transferred to 2 Bitcoin addresses.
The chart below shows which blockchains the funds transferred through Chainflip ultimately flowed to, and the corresponding receiving wallets.
Escape Route 4: Symbiosis
Symbiosis was the fourth-largest fund-transfer channel. Unlike the previous routes, the attacker adopted a scattergun approach here rather than concentrating on large transfers — they transferred 49.71 million TRX to Symbiosis through 1,367 small deposits.
The funds ultimately received included:
- 6,846 ETH, dispersed across 402 Ethereum addresses;
- 130,129 USDC, transferred to Ethereum;
- 14.45 ETH, transferred to Arbitrum.
Another 28 deposits (totaling 1.04 million TRX) failed to swap and were subsequently returned to the attacker's Tron wallet in the form of 336,000 USDT.
The chart below shows which blockchains the funds transferred through Symbiosis ultimately flowed to, and the corresponding receiving wallets.
Other Routes
In addition to the main routes above, the attacker also moved funds through other channels.
Other fund flows out of the Tron network were as follows:
- Bitget Wallet: approximately $41.7 million. Of this, $36.9 million was transferred through its "swap + cross-chain" function, and $4.81 million through its cross-chain bridge. This is a route where a large amount of funds still has an unidentified destination; the relevant destinations are held by the service and remain to be further confirmed.
- USDT0: 5.69 million USDT swapped to 5.5 million USDT0, transferred to Ethereum, with another 33,500 USDT0 transferred to Arbitrum. The remaining $158,500 failed to be delivered successfully and remains stuck in the cross-chain bridge, possibly having been frozen.
- Across Protocol: 4.63 million USDT swapped to 1,615 ETH and 991,000 USDC, transferred to Ethereum.
- Bridgers: $1.51 million.
- NEAR Intents: $171,000.
The final destinations of funds through the Bridgers and NEAR Intents routes remain to be confirmed.
Funds still remaining on the Tron network were as follows:
- JustLend: $12 million, plus $5.2 million transferred through USDT-to-USDD swaps;
- HitBTC and Gate service accounts: $4.17 million and $1.4 million respectively;
- ChangeHero: $432,000;
- Fixed Float and other smaller services.
The chart below highlights these smaller fund-transfer routes, as well as the funds still remaining on the Tron network.
Current Fund Status
As of publication, the attacker still has approximately $7.5 million on the Tron network, while funds already transferred cross-chain continue to move on the Ethereum and Bitcoin networks.
As for the more than $3 billion in assets still controlled by the attacker and held on other blockchains (including 18,270 BTC, approximately 519,000 ETH, 233 million XRP, and 970,000 SOL), these have basically not yet been moved.
The above is the complete tracking of the attacker's fund flows on the Tron network — approximately $242 million was laundered in about two days. I am continuing to track the movement of these funds on the Ethereum and Bitcoin networks, while closely monitoring the more than $3 billion in stolen funds that have not yet been moved.
