Binance Hack: New Findings on Stolen Fund Flows on TRON

AML Crypto and @officer_secret continue to track the movement of stolen assets. Transaction analysis has revealed extensive activity on TRON involving hundreds of addresses.

Key findings

• Between October 29 at 20:44 and October 30 at 12:44, we identified 2,831 outgoing transactions from 284 addresses associated with the attacker.
• The average interval between transactions was 20.35 seconds, with a median of just 3 seconds. 1,099 consecutive transaction pairs shared identical timestamps to the second.
• Activity peaked on October 30 between 06:00 and 06:59 UTC, with 865 transactions in one hour, or approximately one transaction every 4.2 seconds.

The volume and frequency of transfers suggest that the attackers may be using automated tools to generate new addresses and move funds. Some addresses appear repeatedly across different transaction routes, further complicating tracing.

The routes under investigation include interactions with Bitget Wallet, LayerZero, Symbiosis Finance, NEAR Intents, Meson, Allbridge, and ChangeHero.

We also identified unattributed addresses that may be associated with other service providers.
The appearance of a service in these transaction routes does not imply its involvement in the attack.

Call to action

We call on ChangeHero, NEAR Intents, and Binance to review the identified addresses and, where technically feasible, block transactions associated with the attacker.
AML Crypto is ready to provide actionable intelligence on attacker-controlled addresses at no cost, including newly identified wallets as the investigation progresses.