The money stolen from Binance is coming out as USDT on TRON. It's the same coin Brazilian OTC desks sell for Pix

On Saturday, October 31, the FBI attributed to North Korea the attack that drained more than US$ 6 billion from Binance on the night of October 29. In its alert, the agency names the group TraderTraitor — the same one it pointed to in the Bybit theft in 2025 — and says it observed the perpetrators converting the stolen funds "primarily into Ethereum." It expects the money to move through decentralized finance and instant-swap services before the next stages of laundering.

The FBI asked operators of those services, along with exchanges and blockchain analytics firms, to block any transaction involving the addresses used by the group, and published the list: 608 addresses on Ethereum, 19 on bitcoin and 1 on Solana. There is not a single TRON address.

What happened on TRON

TRON is the network where most USDT circulates — the dollar-pegged stablecoin that Brazilian OTC desks buy and sell for Pix. It was one of the networks hit. According to analyst SomaXBT, of the Security Alliance (SEAL), in a post on X dated November 1, 612.7 million USDT and 46.4 million TRX — the network's own token — left Binance wallets on TRON: US$ 628 million in total.

Some of it went nowhere. Tether, the issuer of USDT, can blacklist any wallet in the coin's contract, and the block is recorded on-chain. We checked that record: between 6:09 p.m. and 6:21 p.m. on October 29, Brasília time — less than an hour after the outflows — Tether froze three TRON wallets that today hold 378,719,468 USDT. That is the figure analyses attribute to the freeze of the stolen funds on this network.

The rest moved. By SomaXBT's count, roughly US$ 194 million left TRON through cross-chain bridges, most of it via Relay (US$ 48 million), THORChain (US$ 44 million), Chainflip (US$ 32.1 million) and Symbiosis (US$ 16 million). Another US$ 43 million passed through Bitget Wallet and similar services, with a destination still unidentified. Most of what left was converted into ether: about 53,300 ETH. And roughly US$ 26 million stayed on TRON itself, part of it in exchange deposit accounts such as HitBTC (US$ 4.2 million) and Gate (US$ 1.4 million), and in instant-swap services such as ChangeHero.

Laundering that never sleeps

Elliptic, the blockchain tracing firm, followed the group's main distribution wallet on TRON. It sent funds every single hour for 31 hours straight, without stopping overnight; the longest pause was 46 minutes. By the night of October 31 it had already spread about US$ 196 million across some 200 addresses, was being topped up in batches of roughly US$ 40 million, and the pace had risen to between US$ 7 million and US$ 11 million per hour. The receiving addresses tend to pass the money on within about two minutes.

The signatures, Elliptic says, are machine-driven: transfers almost never less than 30 seconds apart, THORChain swaps with identical amounts (one of them 19 times over) and a system that corrects itself. In the Bybit theft, the firm notes by comparison, the laundering kept business hours. When one bridge rejected a deposit, the funds were resent to the same destination from fresh wallets. According to The Crypto Times, Elliptic co-founder Tom Robinson said there are people steering the operation, with scripts executing the transfers. Chainalysis saw the same pattern: thousands of transactions, funds cycling back to previously used addresses, and many addresses that first receive exactly 1 TRX. The firm also found the Binance funds commingled with proceeds from last month's Bitget exchange theft, likewise attributed to North Korea.

For the OTC market, what matters is the effect: instead of a handful of large, flagged wallets, there are now hundreds of fresh wallets holding small and mid-sized amounts that appear on no list at all.

Why this reaches anyone selling USDT for Pix

Stolen crypto only becomes real money when someone swaps it for local currency. The buyer, at the end of the chain, is an OTC desk, a P2P seller, an exchange with loose onboarding, or an individual who spotted a good price. We don't know whether a single cent of this theft has reached Brazil. We do know that USDT on TRON is the coin that shows up here most: of the 46 wallets submitted to CyberX's wallet lookup since launch, 29 were on TRON, and in 28 of them USDT dominated the activity.

Anyone receiving USDT that passed through a wallet tied to the theft faces two risks:

• The coin can be frozen in your hands. Tether's blacklisting does not separate out the "dirty" portion: it locks the entire wallet, along with everything in it. We've explained how this works and what you can do in Tether can freeze USDT.
• Your exchange account can be blocked. Exchanges are flagging the addresses involved in the attack. A deposit coming from them — or one that passed through them a few hops back — can be held, and you are the one who has to explain its origin.

What to check before closing a deal

• A below-market price, from someone you don't know, this week, is a red flag. Stolen money accepts a discount to get out fast.
• Ask for the source wallet address and look it up before you send the Pix. CyberX's wallet lookup compares the address and its direct counterparties against the OFAC sanctions list, the list in the FBI alert, and the USDT contract's blacklist records. A wallet that received USDT directly from one of the three frozen wallets comes back with a frozen-counterparty alert.
• Know the limits of the lookup. No public list contains the hundreds of fresh wallets Elliptic describes. A wallet created yesterday, with no flagged counterparty, won't trigger anything on list grounds. What the lookup shows in that case is behavior: a recent wallet, money in and out fast, repeated amounts. A signal, not a verdict.
• Keep everything. Pix receipt, address, transaction hash, conversation with the seller. If the coin is frozen later, that is what you use to show you bought in good faith. We laid out the path in I paid by Pix and it became crypto.

And Binance

Binance says it has replaced roughly 95% of the affected amount and that customers will not bear the loss. Withdrawals resumed in phases starting November 1, and the technical report on the attack has yet to be released. We're tracking this in our October 30 story, which is being updated. It also covers the other side of the case: the fake-support scam promising to "release" withdrawals or "refund" those affected. Binance charges nothing for either.

In one line

The proceeds of the largest crypto theft in history are being chopped up as USDT on TRON, outside any public list; anyone buying USDT from a stranger for Pix this week should look up the source wallet, be suspicious of the price, and keep the receipt.

Were you offered cheap USDT, or had a wallet frozen after a purchase? Report the case. A report won't recover your money, but it helps map the route and warns the next person in line.

Sources

• FBI — North Korea Responsible for $6 Billion+ Binance Attack (10/31/2026), with the address list
• Elliptic — The Binance hack is laundering on autopilot (10/31/2026, live updates)
• Chainalysis — Binance Hack: Tracing the $6.4 Billion Theft to North Korea (10/30/2026)
• SomaXBT (SEAL) — post on X (11/01/2026), on where the funds stolen on TRON went
• The Crypto Times — Binance Hack: North Korean Hackers Move $242M in Two Days (11/02/2026), with Tom Robinson's remarks
• USDT contract on TRON — AddedBlackList events from 10/29/2026, 21:09–21:21 UTC, and balances of the three wallets (TG5iBMQ…, TCzBTkq…, TPBkSjk…), accessed 11/02/2026
• Binance — Recovery Update #4: Withdrawals Resume in Phases (11/01/2026)
• CyberX — The scam that follows the Binance attack, Tether can freeze USDT and I paid by Pix and it became crypto