Investigators tracing the $6.3 billion Binance hack have uncovered new details about how stolen cryptocurrency is moving through the TRON network. In this October 31 roundup, Chainalysis describes a technique involving JustLend lending tokens that can help attackers evade stablecoin freezes, while independent investigator SomaXBT has mapped approximately $208 million in TRX across a network of more than 250 wallets. The findings add to evidence of automated laundering activity following the October 29 theft.
Chainalysis estimates that approximately $2.8 billion in stolen stablecoins has been frozen, but the latest investigations show how the attackers are attempting to move other assets beyond the reach of issuer-level restrictions. The $208 million identified by SomaXBT represents cryptocurrency already connected to the Binance incident, not an additional theft.
Chainalysis identifies JustLend route for avoiding stablecoin freezes
Chainalysis reported on October 31 that wallets associated with the Binance exploit had been using decentralized lending infrastructure on TRON to move cryptocurrency through a series of token conversions and newly created addresses.
The technique begins with TRX being exchanged for stablecoins through decentralized trading venues. Rather than keeping those stablecoins in wallets that could be blacklisted by issuers such as Tether or Circle, the attacker deposits them into a lending protocol and receives receipt tokens representing claims on the deposited assets.
Researchers Ian Unsworth and Specter identified the lending infrastructure involved as JustLend, a TRON-based decentralized lending protocol.
Chainalysis explained that the receipt tokens are not subject to the same address-freezing mechanisms as the stablecoins they represent. They can be transfered to another wallet, where the holder redeems them for the underlying stablecoins.
The receipt changes hands, the stablecoin does not, at least not then.
According to Chainalysis, the newly recieved stablecoins can subsequently move through cross-chain bridges and be exchanged for cryptocurrencies such as ETH, which do not have centralized issuers capable of freezing individual token balances.
The method creates an additional layer between the original compromised address and the eventual destination of the funds. It does not make the transaction history invisible, and a fresh wallet address is not necessarily beyond the reach of blockchain investigators.
The mechanism resembles problems documented in an earlier investigation of $621 million in risk-linked USDD conversions on TRON. That research found that wallets subsequently blacklisted by Tether had already moved substantial amounts through token conversions, limiting the effectiveness of freezes applied after the transactions.
Chainalysis illustrated the lending-token technique using a roughly $500,000 transaction sequence attributed to North Korea’s TraderTraitor group. The published example should not be interpreted as establishing that the full $500,000 was newly stolen from Binance, or that every token conversion associated with the current incident used JustLend.
There is also no evidence in the disclosed research that JustLend’s operators knowingly participated in laundering. The transactions involve the use of publicly accessible protocol infrastructure rather than a reported security breach at JustLend itself.
SomaXBT traces $208 million in TRX across 250 wallets
A separate investigation published by blockchain analyst SomaXBT on October 30 identified approximately 628.6 million TRX, valued at about $208 million, remaining on the TRON network in wallets associated with the Binance attacker.
The analyst distinguished two sources of TRX. The first consisted of approximately 46.39 million TRX taken directly during the Binance breach. The second, much larger position was acquired when the attacker converted approximately 232 million stolen USDT into TRX through decentralized exchanges.
That conversion generated roughly 638.2 million TRX, according to the investigation. By the October 30 reporting cutoff, approximately 628.6 million TRX from this second wave remained on TRON, while only about 10 million had moved through identified laundering paths.
SomaXBT reported that four large tranches totaling approximately 518.2 million TRX had not moved. Another address, identified by the shortened label TRBdWq, held approximately 110.4 million TRX after sending out around 10 million tokens.
The four unmoved tranches and the TRBdWq balance together account for the approximately 628.6 million TRX identified in the second wave.
These are large numbers, but large balances and new losses are not the same thing, no.
Most of the original 46.39 million TRX stolen directly from Binance had already moved through layering, swaps or cross-chain routes, according to SomaXBT. The researcher identified activity involving THORChain, Symbiosis and other conversion infrastructure.
The investigation also mapped activity across more than 250 wallets, giving researchers a wider set of addresses to monitor. Those addresses do not establish 250 independent perpetrators, and wallet clustering does not confirm the identity of the individual or organization controlling each address.
A lot of wallets, yes, but not a lot of confirmed owners.
The approximately $208 million valuation reflects the estimated market value of the identified TRX holdings at the reporting cutoff. It is not evidence that an equivalent amount has been sold, cashed out or successfully laundered.
Automated wallet transfers complicate the $2.8 billion freeze effort
Chainalysis has separately identified thousands of transactions involving repeated movements between older and newly created wallets following the Binance breach.
Its October 30 investigation found that some wallets repeatedly recieved small amounts of TRX before receiving larger transfers and forwarding funds elsewhere. Other transaction sequences returned assets to addresses that had appeared earlier in the chain.
The repeated patterns suggest automated transaction processing rather than a series of unrelated manual transfers, according to Chainalysis. The research does not establish that every transaction belongs to the JustLend route identified the following day.
Stablecoin freezes have nevertheless interrupted a substantial portion of the stolen funds. Chainalysis estimates that around $2.8 billion has been restricted through efforts involving Tether, Circle and other industry participants, while Binance has reported approximately $3 billion frozen across affected assets.
The figures reflect different reporting cutoffs and coverage. Freezing assets prevents specified transactions under the relevant token or network controls, but the money does not automatically return to Binance.
The funds were moving, then some were not, and that was where the freeze race stood.
Chainalysis and TRM Labs have attributed the Binance attack with high confidence to TraderTraitor, a North Korean-linked hacking group. Chainalysis said its assessment was strengthened by evidence that proceeds from the Binance breach had commingled with funds connected to an earlier Bitget exploit.
The suspected group has previously been linked to a major exchange theft. In February 2025, the FBI formally attributed the $1.5 billion Bybit theft to North Korea’s TraderTraitor actors, warning that the attackers were distributing stolen cryptocurrency across thousands of addresses and multiple blockchains.
That earlier government attribution supports the group’s documented history, but it is not an official FBI determination regarding the October 2026 Binance incident. Binance has not publicly identified the perpetrators as part of a completed investigation.
Another complication emerged on October 31 when Chainalysis reported that a temporary THORChain trading halt, following an Ethereum chain reorganization and a duplicate refund, had disrupted a cross-chain route potentially available to the attackers. The interruption affected ordinary users as well as suspected illicit transactions and was not described as a targeted asset seizure.
Binance replenishment advances as tracing continues
While investigators follow the stolen assets, Binance is separately replacing the cryptocurrency removed from its wallets.
In its October 31 security update, the exchange said it had replenished approximately 90% of affected assets, up from 80% in its previous announcement. It reported full reserve backing for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
Binance has committed more than $6.34 billion of company resources to cover the theft, drawing on its corporate treasury, Secure Asset Fund for Users and Futures insurance fund. The remaning tokens are being sourced through exchange and over-the-counter purchases.
The exchange also completed a fresh reserve snapshot on October 31, with the full cryptographic proof expected by November 3. Withdrawals were scheduled to begin reopening on November 1, subject to additional security checks.
The wider operational impact has extended beyond the international exchange. Binance TH suspended cryptocurrency withdrawals despite maintaining separate custody arrangements, illustrating how the incident prompted restrictions at an affiliated platform without confirmed compromise of its customer assets.
For investigators, the newly documented JustLend route and SomaXBT’s TRX mapping provide two different views of the same unresolved recovery effort. The first identifies a method for moving value beyond the immediate reach of stablecoin freezes; the second identifies substantial token balances that had not yet left TRON at the analyst’s reporting cutoff.
The investigations follow the initial reports of $3.55 billion in suspicious Binance wallet transfers on October 29, when the available evidence was still insufficient to confirm a theft. Binance subsequently acknowledged the larger security breach, while independent researchers reconstructed the transaction flows across several blockchains.
Whether the newly identified receipt-token transactions ultimately lead to recoverable assets will depend on investigators establishing the full transaction paths and identifying any remaining intervention points. SomaXBT’s wallet map also provides a measurable starting point for following the approximately 628.6 million TRX reported on October 30, without treating future internal transfers as additional losses or confirmed sales.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574