<div style="margin: 24px 0; padding: 18px 20px; border-left: 4px solid #e0a800; background: rgba(224,168,0,0.10); border-radius: 0 8px 8px 0;">
 <p style="margin: 0 0 10px; font-weight: bold; font-size: 0.85em; letter-spacing: 0.05em; text-transform: uppercase;">Key Takeaways</p>
 <ul style="margin: 0; padding-left: 20px; line-height: 1.6;">
  <li>The attackers traded the new token with themselves.</li>
  <li>Lending receipts hid the link from USDT traces.</li>
  <li>TRM matched 11 of 38 bridge orders.</li>
  <li>Freezes need a wallet to land on.</li>
 </ul>
</div>
<p>TRM Labs described the routes in a <a href="https://www.trmlabs.com/resources/blog/binance-hack-update-north-korea-launders-proceeds-through-self-minted-tokens-and-chained-bridges" rel="noopener noreferrer nofollow">November 3 update</a> covering October 31 to November 2, the period when bridges and new TRON methods first appeared in its trace.</p>
<p>About $6.36 billion left Binance wallets across ten blockchains on October 29, according to TRM. The <a href="https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack" rel="noopener noreferrer nofollow">FBI attributed the theft to North Korea</a> on October 31, naming the activity TraderTraitor, the same designation it used for the $1.5 billion Bybit theft in February 2025.</p>
<p>Issuers and networks moved quickly. Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze nearly $2.7 billion within hours. TRM estimates the attacker still holds about $2.4 billion in ETH and BTC, and those main balances showed no new activity as of November 3. The movement TRM is following is on TRON, with funds also starting to pass through a series of Solana wallets.</p>
<p>On TRON, each new method solves the same problem for the attacker: a freeze or an alert has to point at a specific address.</p>
<h2 id="a-token-only-its-creator-could-mint">A token only its creator could mint</h2>
<p>On October 31, an address already in the Binance trace created a token that only its creator can mint. Its sole market was a single pool on a TRON decentralized exchange, pairing the token with a lending protocol’s receipt token. TRM does not name either the exchange or the lending protocol.</p>
<p>TRM breaks the route into three steps:</p>
<div style="display: grid; grid-template-columns: repeat(auto-fit,minmax(180px,1fr)); gap: 12px; margin: 20px 0 24px;">
 <div style="padding: 16px; border: 1px solid rgba(128,128,128,0.35); border-top: 3px solid #e0a800; border-radius: 8px; background: rgba(128,128,128,0.08);">
  <p style="margin: 0 0 6px; font-weight: bold;">1. Fund</p>
  <p style="margin: 0; line-height: 1.55;">Fresh buyer wallets receive TRX from a fan-out <a rel="noopener noreferrer nofollow">wallet</a> in the hack trace, swap it to USDT, convert that into the receipt token and buy the new token.</p>
 </div>
 <div style="padding: 16px; border: 1px solid rgba(128,128,128,0.35); border-top: 3px solid #e0a800; border-radius: 8px; background: rgba(128,128,128,0.08);">
  <p style="margin: 0 0 6px; font-weight: bold;">2. Mint</p>
  <p style="margin: 0; line-height: 1.55;">The creator mints new tokens at no cost and sends them to a separate seller wallet.</p>
 </div>
 <div style="padding: 16px; border: 1px solid rgba(128,128,128,0.35); border-top: 3px solid #e0a800; border-radius: 8px; background: rgba(128,128,128,0.08);">
  <p style="margin: 0 0 6px; font-weight: bold;">3. Withdraw</p>
  <p style="margin: 0; line-height: 1.55;">The seller sells into the pool, takes out the receipt tokens and redeems them for USDT.</p>
 </div>
</div>
<p>The seller’s tokens cost nothing to create, so everything of value it took from the pool had been put there by the buyer wallets, and those were funded from the hack. TRM found no transfer between the buyers and the seller. The pool is their only connection, so a trace watching wallet-to-wallet payments sees unrelated addresses trading a new token.</p>
<p>In one case on November 1, the fan-out wallet sent about 2.94 million TRX to three buyer wallets. The creator then minted 300 million tokens to a seller wallet, which sold them within a minute, withdrew nearly 100 million receipt tokens, redeemed them for USDT and converted that into TRX.</p>
<p>That 100 million is best read as a count of receipt tokens rather than dollars, because a receipt converts to USDT at a rate set by the lending market. TRM’s dollar figure for one such pool is about $2.7 million withdrawn as of November 1.</p>
<h2 id="the-exit-to-ethereum-is-only-partly-traced">The exit to Ethereum is only partly traced</h2>
<p>The seller wallet split its TRX across five new wallets. Between 03:22 and 04:26 UTC, those wallets placed 38 orders worth 966,558 USDT through a swap router built into a wallet app, all paying into bridge wallets of the same cross-chain service.</p>
<p>The service does not publish where its orders pay out, so TRM matched them by amount and timing. Eleven of the 38 orders, about $290,000, line up with payouts on Ethereum, where the funds were swapped into ETH. That accounts for roughly 30% of the batch by value. TRM was still tracing the other 27 orders, and the Ethereum wallets that finally received the funds, when it published.</p>
<p>A match on amount and timing is an inference, not a record from the service itself. It gives investigators specific Ethereum addresses to examine, while leaving most of this batch unplaced.</p>
<p>In another traced case on the same TRON-to-Ethereum route, funds from several TRON addresses arrived at intermediary Ethereum addresses. They were then consolidated, forwarded to a second address and split into chunks of 50 to 80 ETH. That ETH has stayed where it landed. TRM describes this sequence of swapping, consolidating and redistributing as typical of North Korean laundering.</p>
<h2 id="a-deposit-claim-passed-between-wallets">A deposit claim passed between wallets</h2>
<p>TRM flagged the second TRON method on November 2. Wallet A deposits USDT into a lending pool and receives a receipt token representing its claim on that deposit. It sends the receipt to <a rel="noopener noreferrer nofollow">wallet</a> B in an ordinary token transfer. Wallet B redeems it, the pool pays out USDT, and B sends that USDT to a bridge off TRON.</p>
<p>A trace that follows only USDT breaks at the pool. A sends USDT in, and B takes USDT out. Because the pool is large and shared with many other depositors, nothing in the USDT flows ties the two together. B’s only counterparties are the lending market and a bridge, so its history looks clean. The link exists only in the receipt token transfer from A to B.</p>
<p>The receipt carries the deposit itself, not a copy of it. If A deposits $100,000 and hands over the receipt, B can redeem that deposit under the market’s rules, and A is left with no claim of its own.</p>
<p>This differs from <a href="https://coindoo.com/how-the-binance-hacker-outsmarted-stablecoin-freezes/" rel="noopener noreferrer nofollow">the earlier borrowing of ETH against stolen stablecoins</a>. Borrowing leaves a debt secured by posted collateral. Passing a receipt transfers ownership of the deposit outright.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/suspected-106m-crypto-theft-ran-through-familiar-wallets/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2025/04/hacker-0ac8a03d-a782-4516-b5e0-036e41c84c5f.webp"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">Suspected $106M Crypto Theft Ran Through Familiar Wallets</h4>
  </div></a>
</div>
<h2 id="what-a-freeze-needs-to-land-on">What a freeze needs to land on</h2>
<p>Both TRON routes keep the wallet holding hack-linked funds from ever paying the wallet that cashes out. The bridges add a third version of the same idea. TRM has seen the attacker chain two cross-chain swaps, sending funds from a laundering address straight into a deposit address at a second bridge. That skips the intermediate wallet where, in TRM’s words, an alert or a freeze would normally land.</p>
<p>The $2.7 billion stopped in the first hours was stopped at addresses that issuers knew to be tainted. TRM’s advice to compliance teams follows from what these routes break. It recommends following value through receipt tokens and pool tokens and screening several hops downstream, including cross-chain payouts. It also cautions that some payouts can be matched only by amount and timing. A check that looks only at who sent a USDT deposit would pass wallet B.</p>
<p>The largest balances are still parked. The roughly $2.4 billion in ETH and BTC had not moved as of November 3, while the laundering TRM documented on TRON ran from hundreds of thousands to a few million dollars at a time. The <a href="https://coindoo.com/fbi-confirms-north-korea-behind-binance-hack-seeks-blocks/" rel="noopener noreferrer nofollow">FBI’s call to block TraderTraitor-linked wallets</a> depends on someone identifying those wallets first. Every route described here is designed so the next wallet in line has no visible payment history with the last.</p>
<p>The post <a href="https://coindoo.com/binance-hackers-created-token-trade-with-themselves/" rel="noopener noreferrer nofollow">Binance Hackers Created a Token to Trade With Themselves</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Binance Hackers Created a Token to Trade With Themselves

Table of Contents

Coindoo.com

Other articles published on Nov 4, 2026

Join our free newsletter for daily crypto updates!