EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar31 Oct 2026
Chainalysis says the Binance exploiters have parked stablecoins in a Tron lending protocol, then reclaimed them on clean addresses to stay ahead of issuer freezes. About $2.8 billion in stablecoins has already been frozen, but funds swapped into ETH cannot be frozen the same way.
Exchanges TradeReviewed News Desk
The attackers behind the roughly $6.3 billion Binance hack have found a way to stay one step ahead of stablecoin freezes, according to blockchain analytics firm Chainalysis. In a post on X on Saturday, the firm said the exploiters are “stashing their stablecoins in DeFi protocols” and then “claiming them back on new, clean addresses”, a method it says has been used on the Tron blockchain since the early hours of the attack.
How the Tron route works
As The Block summarised the Chainalysis findings, the hackers swapped TRX for various stablecoins and deposited them into a lending protocol, which onchain analysts Specter and Ian Unsworth identified as JustLend. In return they received receipt tokens, which stablecoin issuers cannot freeze. The receipts were then moved to fresh wallets, redeemed for stablecoins, bridged off Tron and swapped for ETH.
The reasoning is simple. Issuers such as Tether and Circle can blacklist an address that holds their token, but a lending pool’s receipt token sits outside that control. Once the funds are back out and converted to ETH, there is no issuer left to freeze them. Chainalysis put it bluntly: “Now the exploiter is free of worry of a freeze.” The firm added that swapping into ETH “does not make the hackers bulletproof”, since the funds can still be traced onchain.
$2.8 billion already frozen
According to the same Chainalysis thread, around $2.8 billion in stablecoins tied to the hack has already been frozen by issuers including Circle and Tether. That follows earlier freezes we covered in our Binance hack stablecoin freeze update. Chainalysis, which puts the total theft at $6.4 billion, also said on Friday it was seeing “never-seen-before laundering patterns”, with thousands of automated transactions cycling funds between old and new addresses.
Separately, Chainalysis disclosed that its own systems were accessed by a hacker using AI agents, exposing non-sensitive customer data such as names and emails. The firm says that incident is not related to the Binance theft. We covered it in our Chainalysis breach report.
What it means for traders
- Recovery odds are shrinking for the unfrozen part. The share already converted to ETH is out of issuer reach, so recovery would depend on tracing and exchange cooperation.
- Watch Tron DeFi and TRX flows. Large deposits and withdrawals in Tron lending pools may draw scrutiny or emergency measures from protocols, which can affect yields and liquidity there.
- Exchange security is the real lesson. Keep only trading balances on any exchange, use 2FA and withdrawal whitelists, and check proof of reserves.
If you are reviewing where to keep trading funds, see our exchange comparison, where BingX ranks first and OKX second, and read how we test exchanges.
This article is for information only and is not financial advice.
Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.
Related reviews
Sources
- Chainalysis on X: The Binance exploiters are rushing to stay a step of stablecoin freezes
- The Block: Chainalysis says hacker using 'offensive agentic techniques' accessed its customers' names and emails
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.