Attacker Swaps 234 Million USDT for 638 Million TRX Amid Sharp Price Surge

Key Facts

An attacker swapped 234 million USDT for about 638 million TRX through SunSwap in a transaction that coincided with a sharp surge in the token’s price on October 29, 2026. Elliptic estimated the size of the swap and said token sales stopped at about 06:36 UTC on October 30. In market trading, TRX rose from $0.331 at 20:00 UTC to $0.362 at 22:00 UTC, a gain of more than 9% in two hours, according to CoinGecko data cited by CryptoTicker. The move places the exceptional demand for the token in the context of funds linked to the Binance hack. But the timing of the swap and the surge does not prove that the swap alone caused the rise.

Elliptic said the attacker converted about $786 million in stablecoins into ETH and TRX before freeze operations were completed. According to its analysis, the TRX purchase followed the conversion of stablecoins, assets that could have been frozen. Bitquery estimated that the attacker paid an average of $0.367 per TRX, compared with about $0.33 in the market at the time of the swap. The main SunSwap pool also rose as much as 18% above the market price at some points. These figures reflect a higher purchase cost than the traded price, alongside pressure on the pool’s liquidity during the swaps. Bitquery data showed that $0.367 was the average price paid, not a fixed price for every unit.

The swaps also affected traders who sold TRX in SunSwap pools; Bitquery said they made $12.4 million before fees. The analysis said the most profitable wallet among those it examined made $1.11 million and traded through a specific on-chain contract. By contrast, TRX’s rise did not last through the end of the month, according to EL7’s daily closing data. The token closed at $0.3524 on October 29, then at $0.3038 on October 31. The decline puts the brief surge in contrast with closing performance two days later. It also highlights the difference between the gain recorded over two hours and subsequent daily closing levels.

The swap was part of a broader hack targeting Binance wallets. TRM Labs estimated that about $6.36 billion in assets moved across ten networks, with most transferred in about 20 minutes starting at 20:05 UTC on October 29. Valuing the same assets at prices at the time its report was published, TRM estimated their worth at about $6.23 billion, compared with their valuation at the time of transfer. Elliptic estimated the stolen crypto assets at about $6.43 billion, while Binance said the impact was about $6.3 billion. TRM compared the incident with the Bybit theft in February 2025, which it estimated at about $1.5 billion, and said the Binance incident was about four times as large. The estimates differ because the firms used different valuation measures in their reports on the incident.

Binance said it worked with blockchain network partners to freeze affected assets worth nearly $3 billion, and had allocated more than $6.34 billion in company funds to cover the stolen assets, according to the Associated Press. The news agency quoted a platform spokesperson as saying that “user funds are completely safe.” It also reported that Binance temporarily suspended deposits and withdrawals while conducting security checks, freezing funds and cooperating with law enforcement. In markets, Bitcoin fell 3.2% to below $79,000 on the evening of Thursday, October 29, according to AP. Binance said it would release additional technical details after the investigation was complete and the facts had been verified. The flow of funds was still developing after the swap: the main wallet distributing TRX sent 1,113 transfers between October 30 and November 1, with a median interval of 90 seconds, according to Elliptic.

After the initial distribution, the funds passed through decentralized exchanges, a lending protocol and at least six cross-chain bridges, according to Elliptic. The company said most funds that crossed the bridges ended up as ETH on the Ethereum network, and that it had matched about $122 million in bridge outflows through its November 1 update. This path shows that the TRX conversion was one stage in a broader movement of assets between networks. At the same time, Elliptic said TRX sales linked to the swap stopped at about 06:36 UTC on October 30. Binance said additional technical details would follow after the investigation was complete and the facts had been verified, while blockchain analytics firms continued to track subsequent transfers.