“We found that the destination address had previously been used by the Phemex hacker,” MistTrack wrote. The tracker published both address sequences and linked a Bitget Bridge order.
Loading post from X…
View post on X
The Tron route began with a transfer of approximately **46.38 million $TRX** from the wallet MistTrack identified as the Binance hacker’s starting address. Smaller batches subsequently moved through the next wallets. The 317,093 $TRX figure measures native-token inputs to the final wallet’s swap router, not the total stolen from Binance.
A Transfer Link, Not an Identity
On Ethereum, the shared destination received **13.61 $ETH** from the penultimate wallet in MistTrack’s Phemex-side sequence before receiving the Bitget-labeled payouts. The published Phemex path spans several transfers and dates: one connection between its upstream wallets was a 0.004 $ETH transfer in December 2025. Those transfers establish connections between addresses, not the identity of their operators.
The trace follows a broader Binance security incident that the exchange estimated at around $6.3 billion. Binance said approximately $3 billion in affected assets had been frozen onchain and that it would cover all losses using its SAFU emergency fund and company funds.
The shared Ethereum recipient had already sent funds onward: its transaction history records a **23.51 $ETH** outgoing transfer after the latest Bitget-labeled receipt shown in the records.
