A wallet holding funds stolen in the record-setting Binance hack has moved 120 million TRX to an unknown address, according to on-chain tracker Whale Alert. The transfer marks the latest step in the attackers' effort to launder proceeds from the October 29 breach — and it illustrates why Tron's native token is proving far harder to claw back than the stablecoins taken in the same attack.

What moved, and where it came from

By October 30, blockchain forensic firms had flagged specific Tron addresses controlled by the attackers, each holding exactly 120 million TRX. Another wallet in the same cluster reportedly held about 158.2 million TRX.

Smaller transfers have continued to trickle out of other addresses linked to the group since the attack. Investigators describe those movements as consistent with peel-chain transfers — a common laundering technique in which stolen funds are passed through a series of addresses in progressively smaller portions. Each slice is small enough to look unremarkable on its own, but together the slices make the original sum harder to follow and easier to cash out in pieces.

The breach behind the money

The attack struck Binance on October 29, 2026, draining roughly $6.3 billion in digital assets from the exchange's hot wallets — the internet-connected wallets exchanges keep funded to process customer withdrawals — across about ten blockchains. The entire operation took around 20 minutes, and the breach has been described as a record event for the industry in both scale and speed.

Tron was one of the hardest-hit networks. Attackers pulled 612.7 million USDT and 46.4 million TRX out of Binance's hot wallets on that chain. They then used SunSwap, a decentralized exchange on Tron, to trade approximately 234 million USDT for an estimated 638 million TRX.

That swap carries more significance than it might first appear. USDT is a stablecoin issued by Tether, and Tether can freeze tokens sitting in specific addresses. TRX, by contrast, has no central issuer with a freeze function. The research findings note that non-freezable assets like TRX continue to pose a challenge for recovery efforts.

Tether and Circle froze approximately $2.7 billion to $3 billion in stablecoins in the aftermath of the attack, an action made possible by that issuer-level control — the same tool both issuers have used to lock funds tied to earlier exploits.

Who is behind it, and how Binance responded

The incident has been attributed with high confidence to TraderTraitor, a North Korean hacking group linked to previous large-scale exploits. United Nations investigators have estimated that North Korean cyber operations have stolen billions of dollars in cryptocurrency in recent years, funds they assess help bankroll the country's weapons programs. Binance is investigating a compromised DevOps laptop as the potential initial attack vector.

The exchange said it would cover all losses for affected customers. It temporarily suspended withdrawals from the impacted wallets — a standard containment step while an investigation is under way — and set aside more than $6.34 billion in company funds to absorb the damage.

Significant portions of the stolen assets — particularly the TRX — remain in the hackers' hands. The research findings describe the attackers as actively laundering the funds.

What this means

The bigger story is the split between what can and cannot be recovered. Stablecoins proved partly recoverable because their issuers can freeze them, and billions of dollars were locked within days. Native tokens like TRX play by different rules: once they leave an exchange's control, recovery depends on tracing, cooperation from other platforms, and catching the money when it tries to exit. In practice, that means watching where the TRX surfaces next — if it lands on exchange deposit addresses, platforms with compliance controls can flag and block deposits tied to an exploit.

The research findings point to increased scrutiny of centralized exchange security and the possibility of stricter protocols across the industry. The findings also suggest that some traders may weigh a shift toward decentralized exchanges after the breach. Notably, the attackers themselves used a decentralized exchange — SunSwap — to move their money into a harder-to-freeze form.

This article is based on reporting by CryptoBriefing, where it was edited by John Chen. Original: 120 million TRX from the Binance hack moves to an unknown wallet