Crypto-tracking platform MistTrack said that $TRX stolen from Binance moved through Bitget Wallet's swap bridge to an Ethereum address connected to the Phemex theft, identifying an overlap between the two transaction trails.

Records from TronScan, the Tron network's public block explorer, corroborate three successive wallet-to-wallet hops in the route published by MistTrack. According to calculations by The Defiant, the final Tron wallet sent approximately 317,093 $TRX, Tron's native token, into a swap router across 10 successful calls. Ethereum records show the destination receiving $ETH from contracts labeled Bitget DEX Aggregator and Bitget Swap 2. Swap services of this kind convert one asset into another through smart contracts, which is how $TRX entering the route on Tron surfaced as $ETH receipts on Ethereum.

The finding connects the Binance fund movements to a transaction history that MistTrack associates with Phemex, a cryptocurrency exchange, giving investigators another trail to examine. It does not, by itself, establish that the same person or group carried out both thefts, nor does it determine whether the shared recipient is an attacker-controlled wallet or an intermediary. Overlapping addresses are among the signals tracing firms flag when they map how stolen funds travel, and such overlaps can reflect either shared operators or reused intermediary infrastructure.

"We found that the destination address had previously been used by the Phemex hacker," MistTrack wrote in a post on X. The tracker published both address sequences and linked a Bitget Bridge order.

The Tron route began with a transfer of approximately 46.38 million $TRX from the wallet MistTrack identified as the Binance hacker's starting address. Smaller batches subsequently moved through the next wallets, and the 317,093 $TRX figure measures native-token inputs to the final wallet's swap router rather than the total amount stolen from Binance. Because Tron's ledger is public, each published hop can be checked independently against explorer records.

On Ethereum, the shared destination received 13.61 $ETH, Ethereum's native asset, from the penultimate wallet in MistTrack's Phemex-side sequence before receiving the Bitget-labeled payouts. The published Phemex path spans several transfers and dates, including a 0.004 $ETH transfer between its upstream wallets in December 2025. Those transfers establish connections between addresses, not the identity of their operators.

The trace follows a broader security incident at Binance that the exchange estimated at around $6.3 billion. Binance said approximately $3 billion in affected assets had been frozen onchain and that it would cover all losses using its SAFU (Secure Asset Fund for Users) emergency fund and company funds.

The shared Ethereum recipient had already sent funds onward: its transaction history records a 23.51 $ETH outgoing transfer after the latest Bitget-labeled receipt shown in the records. Since both the Tron and Ethereum legs of the trace rest on public ledger data, further movement through the published address sequences can be followed in the same records as investigators continue their work.