$93.5 million has been sent out of the main Tron distribution wallet to around 150 wallets, and the wallet has been topped up in batches of $40 million. The pace picked up overnight to between $3 million and $7 million an hour. For scale, $6.43 billion was stolen from Binance, and $2.85 billion of it has been verified frozen (from Elliptic’s main analysis).
For detail on the theft itself, see Elliptic's main analysis .
On October 29, $6.43 billion was stolen from Binance across 11 blockchains. Elliptic's Data and Intelligence team has been tracing where it’s been moving ever since. That work has now uncovered something how the money is being laundered on Tron. The main distribution wallet has been paying out around the clock, at a steady rhythm and with no overnight break, leading us to believe that the pattern is almost certainly software-driven.
In the Bybit hack , the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep.
The main Tron distribution wallet has sent funds every hour for 31 hours straight. The longest pause was 46 minutes, and there was no overnight break.
The timing looks programmed. Transfers are almost never less than 30 seconds apart, and the roughly 150 wallets it pays typically pass funds on within two minutes.
The swaps repeat. Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.
The system corrects itself. When a bridge rejected deposits, the funds were re-sent to the same destination from new wallets, automatically.
Most of it is swapped through THORChain. $25 million has gone into THORChain in total, at a rate of roughly 100 swaps every two hours since midnight.
All figures are from Elliptic’s data as of 08:11 UTC on October 31, 2026.
Where is the money going?
Of the funds we’ve traced from the main distribution wallets, the largest routes so far are:
Source: Elliptic data as of 08:11 UTC , October 31, 2026. Figures will move.
Why does this matter for anyone screening?
Laundering at machine speed means checking once is not enough. A wallet that screens clean can receive funds from the cluster hours later, and with transfers every hour that can happen at 3am on a Sunday. Compliance teams should screen continuously and set alerts, rather than rely on a one-off check or a static list.
How is Elliptic helping?
Labels as soon as they are confirmed. Elliptic's labels exploit addresses as they are confirmed, and those labels flow into our screening tools in near real time.
Rescreening of wallets already cleared. Our systems proactively monitor events that impact the risk score of analyses. Customers using Continuous Monitoring are alerted if activity triggers a rescreen and a change in risk score meets their notification criteria.
Real-time tracing. Elliptic follows funds from any wallet, even one created minutes ago, through every intermediate hop to the nearest known actor, so new wallets carry their risk from the start.
A free blocklist. Elliptic has published a free blocklist of exploit addresses , updated as our investigators trace new addresses. The attacker is still moving funds, so check back regularly. It is free, needs no account and is available as a CSV and through MCP. Screening through Elliptic also catches indirect exposure.
To see how Elliptic can help your team screen against this activity, get in touch .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
