Binance Hack Launderers Moved $500M Through Tron Before Reaching Solana, Chainalysis Says

Published November 1, 2026, 10:50 PM PKT. Based on The Defiant's November 1 report on Chainalysis's latest tracking, The Block's October 31 report on Chainalysis's Saturday update, CoinDesk's October 31 and November 1 reporting on the FBI notice, and Forklog's October 31 report on the FBI attribution. This is a follow-up to MABOnChain's October 31 article on the FBI blaming North Korea for the Binance hack and its November 1 article on the hacker converting $279 million in stolen altcoins.

The launderers behind the October 29 theft of about $6.3 billion from Binance have opened a new leg of their escape route. Blockchain analytics firm Chainalysis said the attackers have begun moving stolen funds onto Solana after draining about $500 million through staging wallets on Tron, The Defiant reported on November 1 at 17:08 UTC, about 40 minutes before this article was prepared. The Tron operation spanned more than 1,000 addresses and more than 3,000 deposits before the funds dispersed across chains, The Defiant said, citing Chainalysis. That scale matters because it shows the laundering is not a handful of manual transfers but an industrial operation: more than a thousand throwaway wallets fed thousands of deposits into the next hop, and the money then fanned out through cross-chain services rather than sitting in one place for investigators to seize.

The $500 million Tron operation: 1,000 addresses, 3,000 deposits

Tron was the staging ground, not the destination. According to a Chainalysis monitoring summary carried by BBX on November 1, the attackers dispersed the Tron funds through more than 1,000 addresses and more than 3,000 deposits, then pushed them through multiple decentralised finance protocols, with the funds flowing through Chainflip, Relay, THORChain and NEAR to dozens of new wallets on Ethereum, Bitcoin and other blockchains. The routing choice is deliberate. Tron carried about $628 million of the original theft, mostly 612.7 million USDT plus 46.4 million TRX, according to TRM Labs' chain-by-chain breakdown, so a $500 million Tron staging operation accounts for most of what was taken on that chain. The cross-chain hop matters for a second reason: once funds leave Tron through a bridge or swap service and land as ether, bitcoin or Solana tokens, the stablecoin issuers' freeze tool no longer applies, since only the issuers can freeze their own tokens. Tether and Circle have frozen more than $2.3 billion of the stolen stablecoins so far, and Chainalysis put the total frozen at about $2.8 billion, but every dollar converted into ether, bitcoin or Solana before a freeze escapes that net entirely.

How the machine works: 1 TRX seeds, receipt tokens, and circular transfers

Chainalysis has been describing the laundering as automated since October 30, when it said it was seeing what it called never-seen-before laundering patterns. The firm said the attackers made thousands of transactions in a short period and, rather than simply forwarding funds to new addresses, repeatedly circulated the stolen crypto among addresses, often sending funds back to wallets used earlier in the same sequence, The Block reported. On Tron, the pattern had a signature: a new address first received exactly 1 TRX, then additional funds, then forwarded them on, according to Chainalysis's account carried by Forklog and AltcoinBuzz. That 1 TRX payment looks like programmatic wallet preparation, a tiny gas payment to activate each fresh address before the real money arrives. A second trick, described by Chainalysis on October 31, used Tron's lending markets to outrun the freezes. The attackers swapped Tron's native TRX token for stablecoins and deposited them in a lending protocol, identified by onchain analysts Specter and Ian Unsworth as JustLend, in exchange for receipt tokens, The Block reported. Receipt tokens cannot be frozen by stablecoin issuers the way USDT and USDC can, so the attackers moved those receipts to clean wallets, redeemed them for stablecoins, and bridged the funds off Tron, swapping them for ether on the other side. One escape route then closed by accident: THORChain, a service that swaps coins between blockchains, paused cross-chain swaps on October 31 after an Ethereum glitch made it pay out a refund twice, and Chainalysis said that pause inadvertently delayed the laundering of a significant amount of funds stolen from Binance, according to The Block and a Medium report by Fathom News. The Solana move reported November 1 shows the operation routing around that delay.

The FBI block list: 600 Ethereum addresses, 19 Bitcoin, one Solana

The new Chainalysis disclosure lands one day after the FBI formally attributed the theft to North Korea's TraderTraitor hacking group, a unit of the Lazarus Group, in a notice published October 31 together with the US Secret Service and IRS Criminal Investigation. The FBI listed more than 600 Ethereum addresses, 19 Bitcoin addresses and one Solana address that either currently hold stolen funds or previously received funds controlled by TraderTraitor, CoinDesk and Forklog reported. The agencies urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from those addresses. The FBI said the attackers had been converting the stolen funds mainly into ether and expected them to keep using swap services and DeFi tools to launder the proceeds. Chainalysis chief executive Jonathan Levin told CoinDesk the attackers had already used thousands of addresses and said he anticipates the count will become tens of thousands over the coming weeks as money moves through a broader laundering network of bridges, instant exchanges and swappers. That forecast is the practical warning inside this story: the 600-plus addresses on the FBI list are a snapshot of a network that is still growing, and compliance teams that screen only the listed addresses will miss the fresh wallets the operation spins up each day.

What Binance has replaced, and what cannot be frozen

Binance, for its part, said on November 1 that it had replaced about 95% of the stolen assets, up from 90% in its October 31 update, using company funds, its Secure Asset Fund for Users and part of its futures insurance fund, and resumed withdrawals in phases the same day, as MABOnChain reported earlier. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, the exchange said. That replacement figure must not be confused with recovery: the 95% is money Binance spent to make users whole, not stolen funds clawed back from the hackers, and the remaining 5% is less liquid tokens the exchange said will take longer to buy. The unfreezable core is the hard limit of the whole chase. Elliptic put about $3.21 billion of the haul beyond any issuer's freeze, including about 519,000 ETH, all 18,270 BTC, 233 million XRP and about 475 million TRX, according to a CryptoCompass analysis of Elliptic's breakdown. Bitcoin has no central issuer and no blacklist function, so those coins can only be stopped when they touch a business that screens deposits. The markers to watch now are whether the Solana leg grows into a second staging operation like Tron's, whether the FBI list expands past its first few hundred addresses, and whether any exchange or swap service reports blocking a deposit tied to the new wallets, which would be the first evidence that the block list is biting rather than just growing.

This article is news reporting and is not investment advice.

Sources

• Chainalysis tracking, as reported by The Defiant, Binance-Hack Launderers Reach Solana After Draining $500 Million on Tron, Chainalysis Says (November 1, 2026, 17:08 UTC, primary source for the new disclosure: about $500 million drained from Tron staging wallets, more than 1,000 addresses, more than 3,000 deposits, funds now moving onto Solana)
• Chainalysis monitoring summary, as carried by BBX, Binance hackers dumped over 130 altcoins on the EVM chain, profiting $279 million (November 1, 2026, secondary source for the routing: funds flowed through Chainflip, Relay, THORChain and NEAR to dozens of new wallets on Ethereum, Bitcoin and other blockchains)
• The Block, Chainalysis says hacker using offensive agentic techniques accessed its customers' names and emails (October 31, 2026, secondary source for Chainalysis's Saturday update: Tron lending protocol receipt tokens via JustLend, THORChain pause inadvertently delaying laundering, and the October 30 never-seen-before automated laundering patterns)
• CoinDesk, FBI confirms North Korea's role in $6 billion Binance hack, asks DeFi community to block BTC, ETH, SOL addresses (October 31, 2026, updated November 1, secondary source for the FBI notice: TraderTraitor attribution, more than 600 Ethereum addresses, just under 20 Bitcoin addresses, one Solana address, and Chainalysis chief executive Jonathan Levin's tens of thousands forecast)
• Forklog, FBI Accuses North Korean Hackers of $6 Billion Binance Breach (October 31, 2026, secondary source for the FBI address counts, the 1 TRX wallet preparation pattern on Tron, and Binance's 95% coverage update)
• CryptoEconomics, Crypto market under pressure following Binance hack and ETF outflows (November 1, 2026, secondary source corroborating the Chainalysis Tron to Solana account and Binance's $3.64 billion first-day net outflows)