Two days after the $6 billion Binance hack, the early on-chain path of the stolen funds is coming into focus.
TechFlowPost reported that more than $3 billion in the hacker’s large Bitcoin and Ether holdings remains largely dormant. After stablecoin issuers froze about $2.7 billion, funds on TRON became the main laundering and disposal route during the first 48 hours.
According to full tracking by on-chain analyst @somaxbt, about $628 million flowed out through TRON, including $612 million in USDT and 46.4 million TRX. On the first day of the incident, Tether froze 378 million USDT.
To avoid further contract-level freezes, the hacker converted about $249 million in assets that had not been intercepted into native TRX and moved about $242 million out through cross-chain bridges over two days.
Four base routes handled most of the cross-chain transfers
A closer look at the data shows that the roughly $240 million in cross-chain transfers mainly moved through four underlying routes, each with a different allocation pattern and level of automation.
THORChain: the largest outflow route
The hacker sent in 185 million TRX and 3.83 million USDT across 2,697 deposits. After bridging, the funds were swapped into 17,000 ETH and spread across 170 Ethereum addresses. Another 53.25 BTC was also generated and distributed to 20 Bitcoin addresses.
Relay Protocol: an unusual growth route
This channel handled 37.64 million USDT and 39.28 million TRX across 735 deposits. The report said Relay has rarely appeared as a core route in past hacks tied to similar groups, yet in this case it became the second-largest outflow path on TRON.
Chainflip: frequent retry behavior
As the third-largest route, Chainflip showed the most complex on-chain activity. The hacker pushed 49.47 million USDT through 571 deposits, with a large number of swap failures during the process. On-chain records show failed refunds were automatically consolidated into new TRON wallets and then sent back into the protocol for repeated attempts, pointing to clear script-driven execution.
Symbiosis: a small-ticket fan-out strategy
On this route, the hacker moved away from large transfers and used a more distributed approach instead. A total of 49.71 million TRX was sent through 1,367 small deposits. After bridging, the funds were swapped into 6,846 ETH and widely fanned out to 402 new Ethereum addresses.
The TRON transit phase is largely over
The report said TRON has largely finished its role as the initial laundering transit hub. Most of the intermediary wallets deployed there have been emptied, with only about $7.5 million in residual value left.
With the TRON route now closed, the $242 million has already been broken up and moved on, leaving no practical window for single-chain interception. But this is only part of the funds. TechFlowPost said the movement of more than $200 million showed that the hacker has a mature, resilient, and fully automated cross-chain laundering pipeline. More than $3 billion in the main holdings is still sitting still. Once that pool starts moving into mixers, existing tracking and interception systems, as well as the market, will face a real stress test.
