TRM Labs said funds linked to the Binance theft moved through new routes between Oct. 31 and Nov. 2, including activity on TRON and cross-chain bridges. In a Nov. 3 update, the blockchain analytics firm said nearly $2.7 billion had been frozen and the attacker still held about $2.4 billion in ETH and BTC.
TRM said that, on TRON, the attacker created a token and pool and funded the pool with stolen proceeds. Its update describes a separate wallet selling newly minted tokens, with no transfer linking the two sides. The firm also described value moving between wallets as a lending receipt token, a method that can hide links from tracing that follows only USDT.
The update says bridges have entered the laundering route. TRM reported funds moving from one cross-chain swap directly into a deposit address at a second bridge.
As of Nov. 3, TRM said its analysis showed no new relevant activity in the main Ethereum and Bitcoin balances, while funds were moving on TRON and Solana. The firm said the attacker still held about $2.4 billion in ETH and BTC. These are TRM’s assessments of blockchain activity.
Information to support your research. Not personal investment, tax or legal advice. Risk & disclaimer
