The Tron wallet that gathered the TRX taken in the Binance hack has been emptied. On-chain records show the address, which received about 684.6 million TRX after the October 29 breach, sent its last sizeable transfer early on Sunday and now holds roughly 131 TRX, along with a handful of USDT.
That ends one stage of a laundering effort that ran for a little over two days, and it follows the steepest two-day drop in TRX in almost two years. On Binance’s TRX/USDT market the token fell about 7.2% on October 30 and another 7.1% on October 31, closing Saturday at $0.3038, its lowest daily close since March.
What the chain shows
AltcoinReporter pulled the full transfer history of the hub address, TRBdWqHnDVSZCVGfgHdKFLQPirQcA2PRki, from TronGrid’s public API on Sunday morning. Six large deposits account for almost all of its incoming TRX: about 46.4 million TRX on October 30, followed by four lots of 120 million TRX and one of about 158.2 million TRX between October 30 and October 31. Together they come to about 684.58 million TRX. The rest of its 831 incoming transfers were dust.
Going the other way, the wallet made 1,113 TRX transfers to 220 different addresses. By our count, about 150.5 million TRX left on October 30, about 487.3 million on October 31 and about 46.8 million on Sunday, before the outflows stopped. At Sunday’s price of roughly $0.31, the full amount is worth a little over $210 million.
An empty hub does not mean the money has been cashed out. The TRX has been spread across hundreds of wallets, and some of it may still be sitting in them. What it does mean is that the large single stack that traders had been tracking no longer exists in one place.
How the stolen USDT became TRX
The TRX itself is the result of a race against Tether. According to TRM Labs, Tether froze 378.7 million USDT in two attacker wallets on Tron. The attacker moved part of the stolen USDT before that freeze took effect.
The on-chain investigation site PublicAML traced that part. It found that a hop wallet sold 199 million USDT for TRX in a SunSwap-style pool between 20:47 and 21:12 UTC on October 29, receiving 638.17 million TRX. Other trackers have put the USDT amount closer to 234 million. Unlike USDT, TRX has no issuer that can freeze it.
The 638 million TRX was split into five lots on October 30. Those lots, plus 46.4 million TRX taken straight from Binance’s Tron hot wallet, all ended up at the same hub. PublicAML described the hub as “where the laundering is happening.” It documented TRX being passed through a mesh of fresh wallets that had each been primed with exactly 1 TRX, run through the lending protocol JustLend, swapped into USDT and USDD, and bridged off Tron through Relay.link, Symbiosis and deBridge. It also counted about 38 million TRX sent into THORChain on the first day and said nothing more went there after 11:38 UTC on October 31, the day THORChain halted trading. AltcoinReporter covered that pause on Saturday.
What happened to the TRX price
Binance daily candles show the hack bracketed by a sharp rise and a sharper fall. TRX gained about 6.9% on October 29, the day the attacker was buying it with stolen USDT, and touched $0.3654. It then lost about 13.8% over the next two days. By our calculation from Binance data, that is the steepest two-day decline for the pair since December 2024.
The timing lines up with the hacker’s selling, since most of the hub’s outflows landed on October 31. But order-book data cannot show how much of the drop came from the attacker and how much came from other traders getting out ahead of an expected dump. TRX was up about 2% on Sunday as the outflows tapered off.
Where the Binance case stands
The Tron funds are a small slice of the theft, which TRM Labs puts at about $6.36 billion. The FBI has attributed the attack to North Korea’s TraderTraitor group and asked THORNode operators, swap services and DeFi platforms to block 628 addresses tied to it. Binance said it has covered about 95% of the lost assets and began reopening withdrawals on 15 networks on Sunday.
Much larger amounts are sitting still. PublicAML counted about 430,737 ETH on four attacker wallets and 18,270.2 BTC on 19 Bitcoin addresses, none of which had sent a transaction as of its last check late on October 31. The Tron leg was the attacker’s fastest-moving pot, largely because TRX could not be frozen once the swap was done.
FAQ
Why did the Binance hacker swap USDT into TRX? Tether can freeze USDT held at specific addresses, and it froze 378.7 million USDT in attacker wallets on Tron. TRX has no central issuer, so converting to it put the funds beyond a freeze.
Has the stolen TRX been sold? Not all of it can be confirmed as sold. The hub has sent out its entire 684.6 million TRX balance to 220 addresses. PublicAML traced part of the TRX into swaps and bridges, but some may still be held in the receiving wallets.
Can exchanges still block these funds? Services can refuse transactions from addresses linked to the theft, and the FBI has asked swap services and DeFi platforms to do exactly that. Once the funds pass through many fresh wallets and cross to other chains, that tracing gets harder.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
