The attacker behind the October 29 Binance hack swapped 234 million USDT for 638 million TRX on SunSwap, according to blockchain analytics firm Elliptic. That works out to about $0.367 per TRX. CoinGecko’s daily snapshot put TRX at $0.329 on October 29, before the swaps. So the attacker accepted a price roughly 11% above where TRX had opened that day. The reason they were willing to overpay is the most useful thing the Binance hack on TRON teaches anyone who holds stablecoins there: Tether can freeze USDT at an address, and nobody can freeze TRX.
💡 Save on TRON fees: instead of burning TRX, rent TRON energy on the TronSave market and cut your USDT (TRC20) transfer cost by up to 90% — energy arrives in seconds.
Elliptic puts the total theft at $6.43 billion; Binance’s own estimate is about $6.3 billion. On October 31 the FBI attributed the attack to TraderTraitor, its name for a North Korean state-sponsored hacking group. As of November 1, Elliptic had verified $2.85 billion of frozen or seized funds, 44% of the theft. Stablecoins made up 94% of that frozen amount, almost entirely on Ethereum and TRON.
A race between the attacker and Tether’s blacklist
Elliptic says the attacker converted around $786 million of stablecoins into ETH and TRX across chains before the freezes landed. On TRON, the conversion was the 234 million USDT that went into SunSwap, TRON’s main decentralized exchange. Token sales there stopped around 06:36 UTC on October 30.
Whatever was still USDT when Tether acted could be locked; whatever was already TRX could not. The swap bet that speed mattered more than price.
What Tether can and cannot reach on TRON
USDT on TRON is a TRC-20 token governed by a contract Tether controls. I read that contract’s ABI from TronGrid on November 5, 2026 (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, contract name TetherToken). It exposes addBlackList, removeBlackList, isBlackListed, getBlackListStatus and destroyBlackFunds. Once an address is blacklisted, its USDT cannot move, and Tether can later destroy the frozen balance and reissue it.
TRX has no equivalent. It is TRON’s native asset, with no issuer and no admin function to call. A blacklisted address can still send TRX, stake it and vote with it; only the USDT balance is stuck. The freeze happens at the issuer, not in the protocol, which is the same mechanism behind Washington’s use of Tether as an enforcement tool on TRON.
The same split exists elsewhere. Elliptic notes that Ripple can freeze RLUSD but not XRP, which is why the 233 million XRP stolen in the same attack sat untouched in one address.
The price of unfreezable money
Paying $234 million for 638 million TRX was expensive. Here is how TRX traded around the swaps, using CoinGecko’s daily (00:00 UTC) snapshots, checked on November 5, 2026:
| Date (00:00 UTC) | TRX price | Value of 638M TRX |
|---|---|---|
| Oct 29 (before the hack) | $0.329 | $210M |
| Oct 30 (mid-swaps) | $0.352 | $225M |
| Oct 31 | $0.329 | $210M |
| Nov 1 | $0.303 | $193M |
| Nov 5 (02:15 UTC spot) | $0.320 | $204M |
At the October 29 price, the attacker gave up about $24 million in slippage to get out of a freezable asset. Measured at today’s price, the paper loss is about $30 million. That is about 13% of the USDT they spent — still far better than losing the whole amount to a freeze.
Daily snapshots cannot show which trades moved the price. The rise into October 30 fits one large buyer in SunSwap’s pools, and the slide fits that TRX being sold back out, but the wider market also fell over those days.
How the Binance hack proceeds left TRON in 1,113 transfers
According to Elliptic, the 638 million TRX was split across five new addresses on the morning of October 30. Over the next two days it was all passed to a single wallet. That wallet sent TRX out in 1,113 separate transfers until it was almost empty on the morning of November 1, with a median gap of 90 seconds between transfers.
The amounts were randomized down to six decimal places, and receiving wallets usually passed funds on within two minutes, some within 30 seconds. Elliptic concludes that much of the laundering was run by software rather than by hand. It adds that the on-chain data cannot show whether that software involved AI agents.
From those wallets, the TRX went through decentralized exchanges and a lending protocol, then across at least six cross-chain bridges. Almost all of it ended up as ETH on Ethereum.
Reports disagree on how much left TRON:
- Elliptic had matched about $122 million of bridge outputs as of its November 1 update.
- AMBCrypto, summarizing Elliptic’s November 2 findings, reported $147 million leaving TRON and funds spread across roughly 7,700 TRON addresses.
- On-chain analyst SomaXBT estimated about $242 million laundered through TRON-linked routes in roughly two days.
The figures cover different windows and methods, so the range is the honest answer. By early November 1, Elliptic said, TRON activity had largely stopped and movement had shifted to Ethereum, Solana and other networks.
Before you accept USDT or TRX from a stranger on TRON
Hack proceeds move through fresh wallets so they can reach ordinary users and OTC desks. A few checks cost nothing:
1. Check USDT senders against Tether’s blacklist. Open the USDT contract on Tronscan, go to Contract → Read, and call isBlackListed with the address. Our guide on how to check a blacklisted USDT address on TRON walks through it step by step. 2. Remember that a clean blacklist result says nothing about TRX. TRX cannot be blacklisted, so stolen TRX looks normal on-chain. Elliptic says it offers a free blocklist covering more than 8,000 addresses; check unfamiliar counterparties against a list like it. 3. Treat discounted OTC TRX with suspicion. Someone selling large amounts of TRX below market for USDT is the exact trade a launderer needs. 4. Know where the real freeze risk sits. Exchanges trace deposits. TRX tied to the hack can be frozen when it lands on a centralized exchange, even though no one can freeze it on-chain.
If you are new to how the token itself works, our explainer on what TRC-20 USDT is covers the issuer model behind these freezes.
What is still unconfirmed
Elliptic put the attacker’s unfreezable holdings at about $3.25 billion as of November 1, spread across more than 800 addresses. AMBCrypto reports Elliptic believes only a small amount has been cashed out so far. How much of the TRON-routed TRX has actually been sold for fiat is not known. Tether’s exact freeze total on TRON alone has not been broken out in the sources I reviewed. This post does not cover the attack vector on Binance’s side, which Elliptic documents separately.
Sources: Elliptic’s Binance hack report (updates through November 1, 2026), AMBCrypto’s November 2 summary, CoinGecko price history, and the USDT contract ABI read via TronGrid on November 5, 2026. Nothing here is investment advice.
FAQ
How much was stolen in the Binance hack?
Elliptic estimates $6.43 billion in cryptoassets were stolen on October 29, 2026; Binance puts it at about $6.3 billion. The FBI attributed it to North Korea’s TraderTraitor group on October 31.
Why did the Binance hacker swap USDT for TRX?
Tether can blacklist a USDT address and freeze its balance; TRX has no issuer and cannot be frozen on-chain. Elliptic reports 234 million USDT went into SunSwap for 638 million TRX.
Can Tether freeze TRX?
No. Tether controls only its USDT token contract. A blacklisted TRON address can still send, stake and vote with TRX; exchanges can still freeze TRX once it is deposited with them.
How do I check if a TRON address is blacklisted?
Call isBlackListed on the USDT contract (TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t) through Tronscan’s Read Contract tab. A true result means that address’s USDT is frozen.
