Blockchain analytics firm Elliptic says 638 million TRX derived from assets stolen in the Binance breach was dispersed through fresh wallets and at least six cross-chain bridges before nearly all of the traced value emerged as ETH on Ethereum. The finding comes from Elliptic's final November 1 update to its tracing analysis. It describes how part of the stolen portfolio moved after the theft; it does not establish that the assets were converted to fiat, nor does it provide a final accounting of recoverable losses.

Funds fragmented before reaching bridges

Elliptic said 234 million stolen USDT had first been exchanged for 638 million TRX. The TRX was split across five addresses, consolidated into a single wallet and then distributed to dozens of newly created wallets. Those wallets sent funds through at least six cross-chain bridges. Elliptic said it matched about $122 million of bridge outputs to Ethereum and found that some of the resulting ETH was combined with proceeds linked to the earlier Bitget exploit. The matched amount is a tracing figure, not necessarily the total value that crossed chains.

Related reporting: FBI Attributes $6 Billion Binance Theft to North Korea

Independent estimates use a broader measure

The Block separately reported estimates from on-chain analyst SomaXBT, who said roughly $242 million of TRX-derived funds had been moved and about $194 million had left Tron through bridges and swaps. The analyst attributed approximately $48 million to Relay, $44 million to THORChain, $32.1 million to Chainflip and $16 million to Symbiosis. The Block said it directly checked one cited Ethereum address, but the aggregate figures remain the analyst's estimates. They should not be added to Elliptic's $122 million match because the methods, cut-off times and categories differ.

Transfer timing points to scripts

Elliptic counted 1,113 TRX transfers between October 30 at 02:00 UTC and November 1 at 05:33 UTC. The median interval was 90 seconds, while the longest pause before a wallet was depleted was 39 minutes. The firm said the regularity and rapid splitting indicate that scripts probably coordinated the transfers. That assessment is narrower than a claim that an AI system ran the operation: automated transaction software can follow fixed rules without using a generative model or autonomous agent.

Fresh addresses complicate blocking lists

The FBI attributed the more than $6 billion Binance theft to North Korea's TraderTraitor activity on October 31 and urged exchanges, infrastructure operators, DeFi services and analytics firms to block transactions from listed addresses or funds derived from them. The agency said it had observed the actors converting stolen assets primarily into ETH and expected further laundering through DeFi and instant-swap services. The fresh wallets in Elliptic's analysis illustrate why derived exposure must be traced beyond the first published addresses rather than treated as a static list.

Balances and routes can still change

At Elliptic's final snapshot, the theft-linked holdings it tracked included about 584,000 ETH, 18,327 BTC and 233 million XRP. Those are time-specific on-chain observations, not guaranteed live balances. Bridge outputs can be split again, merged with unrelated flows or moved to new services. A complete assessment will therefore depend on continuing attribution work, disclosures from the affected platforms and any later seizures or freezes. The present evidence supports a detailed route across Tron and Ethereum, not a conclusion that the funds have disappeared beyond recovery.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.