Binance hack: where the attacker's Tron money went on Oct 31.
From 00:00 to 17:06 UTC about $100M left the attacker's Tron wallets, net of refunds: about 270M TRX plus stablecoins, at a TRX price of $0.31.
We measured $68M of it, or 68%, exit by exit on-chain:
THORChain: about $31M net. THORChain also refunded about 43M TRX, and the attacker has not used it since 12:28 UTC.
Relay (relay.link): $20.2M, all of it after 12:00 UTC.
Chainflip: about $7.7M net. Another $8.2M came back as refunds, mostly deposits that Chainflip's broker rejected (84).
Bitget Wallet bridge, sent directly: about $4.4M.
Symbiosis, sent directly: about $4.0M.
deBridge and USDT0: about $0.7M.
The other ~$32M went to fresh relay wallets in small pieces. Part of it reached the same bridges, and part we have not traced yet.
After 12:00 UTC about $41M left, about half of it through Relay.
From 00:00 to 17:06 UTC about $100M left the attacker's Tron wallets, net of refunds: about 270M TRX plus stablecoins, at a TRX price of $0.31.
We measured $68M of it, or 68%, exit by exit on-chain:
THORChain: about $31M net. THORChain also refunded about 43M TRX, and the attacker has not used it since 12:28 UTC.
Relay (relay.link): $20.2M, all of it after 12:00 UTC.
Chainflip: about $7.7M net. Another $8.2M came back as refunds, mostly deposits that Chainflip's broker rejected (84).
Bitget Wallet bridge, sent directly: about $4.4M.
Symbiosis, sent directly: about $4.0M.
deBridge and USDT0: about $0.7M.
The other ~$32M went to fresh relay wallets in small pieces. Part of it reached the same bridges, and part we have not traced yet.
After 12:00 UTC about $41M left, about half of it through Relay.
