How refused bridge deposits gave the Binance thief clean wallets

Prologue: four hours on a Thursday night

At 20:04 UTC on Thursday 29 October 2026, an Ethereum account labelled as a Binance wallet signed a single permission. It handed another contract the power to act as the account itself, and to move everything in it. Four hours later, about $6.09 billion had gone.

The permission was an Ethereum delegation under EIP-7702. Minutes later came the first sweep, and by 23:56 UTC 393 separate drains had emptied wallets across five chains.

Two days later the FBI said who it believed was behind it: North Korean activity it calls TraderTraitor. That is the FBI’s attribution, and we repeat it only as theirs.

The thief turned refused deposits into a laundering tool, used a lending market as a courier, rushed coins into a Bitcoin mixer and pulled them out again a day later (inferred, not proven). For all that effort, most of the money still sits where it landed.

99.7% of the $6.09 billion is accounted for: frozen, sitting in wallets on the trail, paid into services such as bridges and swap desks, or burned in fees.

Part one: the money that froze, and the money that sat still

The first hours belonged to the issuers.

At 21:01:35 UTC, while the drain was still running, Tether blacklisted the main receiving wallet. Circle followed at 21:04:59. On Ethereum alone, 1.38 billion USDT and 823 million USDC, about $2.2 billion, were frozen where they sat.

On Tron, two of the thief’s wallets hold 378.72 million USDT that cannot move: 312,729,468 USDT in one and 65,990,000 USDT in the other. The USDT contract’s own blacklist check returns true for both. Across every chain, our tally puts about $2.68 billion of the theft frozen, roughly 44%.

Then there is the money that simply waits. At the cut-off:

• 18,329 BTC sits in wallets on the trail. None of the drained Bitcoin has left.
• 537,398 ETH sits in wallets on the trail. Nine hold 529,652 of it.
• 233.46 million XRP, split six ways in the early hours of 2 November, has not moved since.
• 12.3 million NEAR rests.
• On Solana, 485,277 SOL sits untouched in a single account.

That is billions of dollars that the thief holds and cannot easily spend. So the thief started small, and started clever.

Part two: the door that said no

The thief’s favourite route out of Tron was a cross-chain swap service, Chainflip. You open a deposit channel, send your coins, and the network pays out the asset you asked for on the other chain. When you open the channel you also name a refund address, in case anything goes wrong.

Something did go wrong. Chainflip’s broker began refusing deposits. The record shows each refusal, though not the reason for it. Between 30 October and 2 November it refused 164 deposits, and we trace 149 of them back to the theft’s wallets.

Here is the twist. A refusal does not keep the coins. It sends them back, to the refund address the depositor chose. And the thief had nearly always chosen a wallet with no history at all.

So the refusal itself became the laundering step. Coins went in; the broker said no; the same coins came back to a clean, fresh wallet. Minutes later that fresh wallet tried again. And this time, the coins went through.

The numbers, from the swap records and refund transactions:

• 151 Tron USDT deposits refused between 30 October 14:03 and 31 October 16:06 UTC, worth 13.12 million USDT. Most of them trace back to the theft’s wallets in one to four hops (inferred, not proven).
• The 151 refunds went to 131 wallets that had never been used before, 13 of them used more than once. The refund address was nearly always a fresh one.
• 128 of those fresh wallets sent the money again, 213 times, typically within minutes. 197 of the retries went through, paid out as fresh ETH.
• A further eight Tron refusals (717,932 USDT) refunded to a single wallet, each converted to the USDD stablecoin within a minute and tried again from a new address.
• And five Ethereum refusals on 2 November, 103.2 ETH in all. The last refund landed at 21:43 UTC.

The broker refused the sender, and the refund created a clean one. Every refusal, refund and retry is on chain. Their links to the theft are inferred, not proven, and fifteen refusals and fourteen retries are not traced at all. On Tracer’s trail map, this route is the Refund bounce.

Part three: the circle

Follow one of those retries and you find that the bounce was not a line. It was a loop.

The same public swap bridge carried 224 Tron-to-Ethereum swaps worth $19.34 million between 30 October and 1 November, turning Tron USDT into ETH, lot by lot, on average about $86,000 a time. One of the Ethereum wallets that received this ETH then did something strange on 2 November. From 11:22 to 22:37 UTC it cut the ETH into lots of 10.5 to 17.8 ETH, and one of 39.3, and sent each through one to six brand-new wallets within minutes.

At the end of every one of those chains was a Chainflip deposit channel, swapping ETH into Bitcoin. And the last wallet before each channel was one of the five senders whose deposits the broker refused.

So the whole thing turns in a circle on one bridge: Tron USDT, into Chainflip, out as ETH, through fresh hops, back into Chainflip as ETH-to-Bitcoin, refused, refunded to a clean wallet, sent again, and finally paid into the thief’s Bitcoin gathering wallet (inferred, not proven). Every hop has a transaction id; that the ETH entering this loop came from the theft is inferred, not proven.

The swaps paid out about 8,570 ETH. The wallets they fed hold about 8,600 ETH, some of it pooled from other swap payouts, one to four hops from the swap and untouched at the cut-off: 6,558 ETH in 81 holders, plus 2,042 ETH in 16 more. (The hops are recorded; for the swaps whose senders we have not tied to the theft, the link is inferred, not proven.)

Part four: ninety minutes to the mixer

On the night of 1 November, the thief tried something faster.

At 02:10 UTC, Tron wallets we trace directly to the theft began sending TRX in lots: 363,038 TRX, then four more, by 02:41. The TRX was wrapped and swapped on a decentralised exchange into 647,160 USDD.

Then came the courier trick.

Instead of sending the USDD to a new wallet, which would leave an obvious transfer between the two, the thief deposited it into a lending market, JustLend, at 04:12:42 UTC. The market issued a receipt token in return. The thief handed the receipt token, not the USDD, to a fresh wallet at 04:16:12. And at 04:18:54 that fresh wallet redeemed it for the full 647,160 USDD.

On the chain, this looks like two strangers: one account deposits into a pool, another withdraws from it. The USDD never moves between them. Deposit under one name, withdraw under another. (That both accounts are the thief’s is inferred, not proven.)

(The next night, between 23:36 on 1 November and 02:20 UTC on 2 November, the same trick ran again, this time after a careful test ladder: receipt tokens worth 1,000, then 2,000, then 20,000, then 100,000, then 200,000, then 313,252 USDD, each step passed on within about forty seconds. That second leg is inferred, not proven until its sources are fully walked back.)

The rest happened fast. The fresh wallet split the USDD three ways, beginning with 200,000 USDD at 04:22:24. Each recipient swapped it back to USDT and fed it into Chainflip in six swaps of 100,000 to 120,000 USDT, the first at 04:29:45. Chainflip paid out fresh Bitcoin.

At 05:55 UTC, four of those freshly paid Bitcoin coins were among the first inputs of a Wasabi CoinJoin round (inferred, not proven).

From Tron stablecoin to a Bitcoin mixer in about ninety minutes.

And there was a second door into the same rounds. At 05:59 UTC, part of the same money, refunded from those swaps and recycled, went out in three lots of 20,000, 30,000 and 43,557 USDT into a second bridge on Tron. Eight minutes after the last lot, at 06:11:21, that bridge paid out the first of three Bitcoin coins, 1.20 BTC in all, and they went into the same mixer rounds (inferred, not proven).

In all, we trace 8.24 BTC of the thief’s coins into three CoinJoin rounds between 05:55 and 07:15 UTC that day (inferred, not proven).

Part five: the mixer bought one day

A CoinJoin is built to end the trail. Hundreds of coins from many wallets go in; everyone takes coins out in the same standard sizes; nobody can say whose came back to whom. For most observers, this is where the story stops.

This one left a trail. 6.66 BTC of the thief’s coins can be followed out of the rounds (inferred, not proven). Those coins moved on through further rounds. And then, on the morning of 2 November, they were spent.

It happened in four transactions between 09:07 and 09:22 UTC (inferred, not proven).

The spender was in a hurry. The rounds were clearing at under 1 satoshi per byte; these spends paid 50 to 67.

And the money went back the way it came. 6.41 BTC went into the same public swap bridge, Chainflip, that had carried the Tron USDT in the day before. 1.62 BTC of it was refunded. The other 4.79 BTC was swapped out. One swap paid 118,351.64 USDT to a wallet on Tron. Two more paid 253,345.18 USDC to a wallet on Ethereum.

Then the two halves came together.

At 09:27 UTC the Ethereum wallet swapped its USDC to 253,583 USDT. Two minutes later it pushed the USDT over another bridge to Tron. The recipient written inside that bridge message was the very same Tron wallet that had taken the first 118,352 USDT. After the bridge fee, 253,456 USDT arrived.

Bitcoin mixer, swap bridge, USDC, web swap, another bridge, Tron: within 40 minutes of the first exit, all 371,808 USDT had passed through one wallet, arriving at 09:09 and 09:34 UTC (inferred, not proven).

Each half was forwarded within ten minutes. That wallet passed 118,348 USDT and then 253,455 USDT on within minutes to a wallet that was already active a week before the theft, which we treat as a service. It forwarded both the same day to a busy, untagged wallet with more than 10,000 transfers since January, which we also treat as a service. That wallet paid 350,000 USDT onward 33 seconds after the second arrival. The trail ends there, at a service. All of it could still move at our last read.

The mixer did not end the trail. It bought the thief one day.

Every hop and every transaction id of this case is free to read on Tracer, where this investigation lives.

Part six: the side doors

The mixer was the dramatic route. It was not the only one.

Another bridge, all in USDT. Wallets tied to the case paid 6.77 million USDT into another bridge on Tron in 409 deposits between 30 October and 2 November. About 3.1 million of that came straight from wallets we trace to the theft. For the rest, the link is inferred, not proven. Every one asked for USDT on the other side, mostly on Ethereum, the rest on Arbitrum, BNB Chain and Polygon. On Ethereum, almost all of it was converted to ETH or USDC on arrival. On Arbitrum, the USDT reached fresh wallets, among them one that took about 300,000 USDT and another about 51,000.

The second bridge, to Ethereum. 319 deposits worth 33.35 million USDT crossed a second bridge out of Tron, 99.7% of it in ten hours on 31 October, between 13:45 UTC and midnight. 260 were paid out on Ethereum, 45 went to a derivatives exchange, 3 to Bitcoin, and 11 were refunded. Most of it became ETH. The wallets it paid, topped up from elsewhere, moved 14,959 ETH into 22 fresh wallets, untouched since 31 October (publicly linked, not proven). Two of the deposits, each with its payout: a Tron deposit and its payout, and a second deposit and its payout. 47 of the deposits, worth 4.50 million USDT and nearly all in the derivatives-exchange and Bitcoin legs, came from wallets that trace back to the theft (inferred, not proven). The other 272, the whole Ethereum leg among them, came from wallets publicly linked to it (publicly linked, not proven).

Four systems in under a minute. On 2 November at 10:51:48 UTC, a Solana wallet linked to the case (inferred, not proven) burned 28,245.84 USDC through Circle’s cross-chain transfer, addressed to a forwarding account on the Noble chain that did not exist until 34 seconds later. Noble minted the USDC, and the account automatically relayed it into a trading account on a derivatives exchange. Solana, Noble, a Cosmos relay, an exchange account: no bridge website, under a minute. (The route itself is recorded at every step; the amount is small.) Separately, 3.27 million USDC on Solana moved into four fresh wallets (inferred, not proven).

The wider ring. Beyond the wallets we trace directly, a further 531 wallets publicly linked to the theft moved 60.8 million USDT after 31 October. Their connection to the theft is inferred, not proven, and they are kept separate on the case.

Part seven: habits

The operator has habits. None of them names anyone. All of them are in the record.

• Test first. Dust swaps before new routes; 0.01 ETH tests on new bridges; a six-step test ladder before the courier run.
• Small lots. ETH cut into 17.5 to 17.8 ETH deposits; Tron USDT into lots of 66,000 to 200,000.
• Fixed pairs. Each of 95 Tron wallets that used one of the bridges always paid one and the same Ethereum wallet, with no exceptions.
• Gas first. Fresh wallets funded with exactly 0.05 ETH, then used as a relay for 1,882 ETH into one holder that now sits on 9,788 ETH.
• Nothing big moves. The 1,000-BTC wallets and the six-figure ETH wallets have not been touched.

Where it stands: the morning of 3 November

The thief has pushed a small fraction of the haul through bridges, a lending market and a mixer. The billions are still sitting in plain sight, or frozen. Every route read to its end has ended at a service that can be asked who its customer was. The rest sits in fresh wallets, or is still being resolved.

Every movement leaves a trace.

This investigation continues on Tracer: every hop, every transaction id, and what is proven and what is only inferred. Go to Tracer to see more of this investigation.

Valuation notes: USDT and USDC at nominal dollar parity, without assuming redemption. Totals are as read at 23:00 UTC on 2 November 2026 and are not a final loss estimate. The FBI attribution is the FBI’s. We name no individual.