Blockchain analytics firm TRM Labs has detailed how the attackers behind the Binance exploit are laundering stolen proceeds through self-minted tokens, lending-receipt transfers and chained cross-chain swaps — techniques engineered to break the direct payment links on which asset freezes depend. In a November 3 update covering October 31 to November 2, the period when bridges and new TRON-based methods first appeared in the firm's trace, TRM mapped a series of routes built around a single principle: the wallet holding hack-linked funds should never pay the wallet that ultimately cashes out.

About $6.36 billion left Binance wallets across ten blockchains on October 29, according to TRM. The FBI attributed the theft to North Korea on October 31, designating the activity TraderTraitor — the same label it applied to the $1.5 billion Bybit theft in February 2025.

Issuers and networks moved quickly. Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze nearly $2.7 billion within hours. TRM estimates the attacker still holds about $2.4 billion in ETH and BTC, and those main balances showed no new activity as of November 3. The laundering the firm is now following is concentrated on TRON, with funds also beginning to pass through a series of Solana wallets.

On TRON, each new method solves the same problem for the attacker: a freeze or an alert has to point at a specific address.

A Token Only Its Creator Could Mint

On October 31, an address already within the Binance trace created a token that only its creator can mint. Its sole market was a single pool on a TRON decentralized exchange, pairing the token with a lending protocol's receipt token. TRM did not name either the exchange or the lending protocol.

TRM breaks the route into three steps:

1. Fund — Fresh buyer wallets receive TRX from a fan-out wallet in the hack trace, swap it to USDT, convert that into the receipt token and buy the new token.
2. Mint — The creator mints new tokens at no cost and sends them to a separate seller wallet.
3. Withdraw — The seller sells into the pool, takes out the receipt tokens and redeems them for USDT.

Because the seller's tokens cost nothing to create, everything of value it took from the pool had been put there by the buyer wallets — and those were funded from the hack. TRM found no transfer between the buyers and the seller; the pool is their only connection. A trace watching wallet-to-wallet payments therefore sees a set of apparently unrelated addresses trading a new token.

In one case on November 1, the fan-out wallet sent about 2.94 million TRX to three buyer wallets. The creator then minted 300 million tokens to a seller wallet, which sold them within a minute, withdrew nearly 100 million receipt tokens, redeemed them for USDT and converted the proceeds back into TRX.

That 100 million figure is best read as a count of receipt tokens rather than dollars, because a receipt converts to USDT at a rate set by the lending market. TRM's dollar estimate for one such pool is about $2.7 million withdrawn as of November 1.

The Exit to Ethereum Is Only Partly Traced

The seller wallet split its TRX across five new wallets. Between 03:22 and 04:26 UTC, those wallets placed 38 orders worth 966,558 USDT through a swap router built into a wallet app, with every payment going to the bridge wallets of the same cross-chain service.

The service does not publish where its orders pay out, so TRM matched them by amount and timing. Eleven of the 38 orders — about $290,000 — line up with payouts on Ethereum, where the funds were swapped into ETH, accounting for roughly 30% of the batch by value. When the firm published, it was still tracing the other 27 orders and the Ethereum wallets that finally received the funds.

A match on amount and timing is an inference, not a record from the service itself. It gives investigators specific Ethereum addresses to examine, while leaving most of this batch unplaced. The remaining orders and the wallets receiving the reported Ethereum payouts are therefore the clearest unresolved elements in this part of TRM's trace.

In another traced case on the same TRON-to-Ethereum route, funds from several TRON addresses arrived at intermediary Ethereum addresses. They were then consolidated, forwarded to a second address and split into chunks of 50 to 80 ETH. That ETH has stayed where it landed. TRM describes this sequence of swapping, consolidating and redistributing as typical of North Korean laundering.

A Deposit Claim Passed Between Wallets

TRM flagged the second TRON method on November 2. Wallet A deposits USDT into a lending pool and receives a receipt token representing its claim on that deposit. It sends the receipt to Wallet B in an ordinary token transfer. Wallet B redeems it, the pool pays out USDT, and B sends that USDT to a bridge off TRON.

A trace that follows only USDT breaks at the pool: A sends USDT in, and B takes USDT out. Because the pool is large and shared with many other depositors, nothing in the USDT flows ties the two together. B's only counterparties are the lending market and a bridge, so its history looks clean. The link exists only in the receipt token transfer from A to B.

The receipt carries the deposit itself, not a copy of it. If A deposits $100,000 and hands over the receipt, B can redeem that deposit under the market's rules, and A is left with no claim of its own.

This differs from the earlier borrowing of ETH against stolen stablecoins. Borrowing leaves a debt secured by posted collateral. Passing a receipt transfers ownership of the deposit outright.

What a Freeze Needs to Land On

Both TRON routes keep the wallet holding hack-linked funds from ever paying the wallet that cashes out. The bridges add a third version of the same idea. TRM has seen the attacker chain two cross-chain swaps, sending funds from a laundering address straight into a deposit address at a second bridge. That skips the intermediate wallet where, in TRM's words, an alert or a freeze would normally land.

The $2.7 billion stopped in the first hours was frozen at addresses that issuers knew to be tainted. TRM's advice to compliance teams follows from what these routes break: follow value through receipt tokens and pool tokens, screen several hops downstream — including cross-chain payouts — and recognize that some payouts can be matched only by amount and timing. A check that looks only at who sent a USDT deposit would pass Wallet B.

The largest balances remain parked. The roughly $2.4 billion in ETH and BTC had not moved as of November 3, while the laundering TRM documented on TRON ran from hundreds of thousands to a few million dollars at a time. The FBI's call to block TraderTraitor-linked wallets depends on someone identifying those wallets first. Every route described in the update is designed so the next wallet in line has no visible payment history with the last.

This article is adapted from Coindoo's original report, Binance Hackers Created a Token to Trade With Themselves.