On-Chain Data Breakdown of the Initial Fund Flows in the Major Binance Hack: Where Did the $240 Mil

Binance's $6 billion hack has seen its initial on-chain money-laundering trail mapped out, with roughly $628 million drained via TRON — including $612 million in USDT and $46.4 million in TRX — before Tether froze $378 million in USDT on day one. With stablecoin issuers freezing about $2.7 billion in total, the hacker converted roughly $249 million of remaining assets into native TRX and bridged out approximately $242 million within 48 hours through four channels: THORChain (the largest, via 2,697 deposits of 185 million TRX and $3.83 million USDT, swapped into 17,000 ETH across 170 addresses and 53.25 BTC across 20 addresses), Relay Protocol ($37.64 million USDT and $39.28 million TRX across 735 deposits — an unusual choice for this group), Chainflip ($49.47 million USDT across 571 deposits with automated retry logic after failed swaps), and Symbiosis (49.71 million TRX in 1,367 small deposits fanned out as 6,846 ETH to 402 new Ethereum addresses). The TRON relay wallets are now physically emptied, leaving only about $7.5 million in residual value, meaning the single-chain interception window for that $242 million has closed. The demonstration reveals a mature, fully automated cross-chain laundering pipeline, while the hacker's core stash — over $3 billion in largely static BTC and ETH — remains untouched. Watch for whether existing tracing and freezing mechanisms can withstand that larger tranche when it begins moving.