1,113 Tron transfers… Traces of automation in Binance theft funds

Binance exploit funds were funneled through a single Tron (TRX) wallet in 1,113 separate transfers between October 30 and November 1, blockchain analytics firm Elliptic reported, with a median interval of 90 seconds and the longest gap just 39 minutes. The transfers continued even during Pyongyang's nighttime hours, and most amounts were irregular to six decimal places, with receiving wallets typically forwarding funds onward within about two minutes—patterns Elliptic says point to software automation rather than manual transfers, consistent with laundering tactics attributed to North Korean actors. The finding matters because it offers fresh forensic evidence of industrialized, scripted money movement following the Binance theft, aiding attribution and recovery efforts. On Ethereum, stolen Chainlink (LINK) tokens were also observed moving, though the article's coverage of that leg was truncated. Watch for further Elliptic or exchange-side disclosures tracing the funds across chains and any freezes or recoveries by Binance or counterparties.