Tron below its pre-hack level: the attacker still holds 475 million TRX

What is established: the TRX price stands at $0.3097 on November 1, below the level of about $0.33 that the market showed before the attack on Binance on October 29. In its version of October 31, the analytics firm Elliptic still attributes about 475 million TRX to the attacker. Our assessment follows further down: for the price, this known stash weighs more heavily than any level on the daily chart.

The case is interesting for holders in Germany because, unusually, it is known who is selling and how much is left. In most price moves the other side remains anonymous. On the Tron blockchain, by contrast, the stash can be followed address by address.

Tron falls below its level before the attack on Binance

Tron costs $0.3097 on November 1, according to CoinGecko data. The daily high was $0.3278, the daily low $0.3017, and trading volume $1.39 billion. With a market value of $29.43 billion, TRX remains number eight in the market.

How large the decline over 24 hours is depends on the time window and the data provider. CoinGecko shows a drop of 4.97 percent at that point. Invezz, citing CoinPaprika, gives 7.0 percent for Saturday evening, measured at 17:50 London time at $0.308, and also points to the exchange OKX, which showed a 9 percent drop for its own 24-hour period. The range of about five to nine percent is explained by the starting point of each measurement.

The comparison with the level before the incident is what matters. Bitquery traced how the attacker swapped 234 million USDT into TRX on the decentralised exchange SunSwap, paying an average of $0.367 per token while the market price was about $0.33. That purchase briefly lifted TRX to about $0.37 on Kraken late on October 29. Nothing remains of this artificially created high, and the $0.33 from before the attack has also been breached.

475 million TRX with the attacker: Elliptic's count

Elliptic puts the total damage at $6.43 billion, drained on October 29, 2026. Of this, the firm says it has verified $2.85 billion as frozen or seized. That leaves a stash of about $3.21 billion that no issuer can block. According to Elliptic, this sum includes 519,104 ETH, 18,270 BTC, 233 million XRP and those roughly 475 million TRX.

TRM Labs attributes the attack to the North Korean group TraderTraitor and gives a damage figure of about $6.36 billion. Binance itself speaks of $6.3 billion. The attribution to a state-linked group is an assessment by the analytics firms, not a judicial finding; the identity of the perpetrators is unconfirmed.

According to TRM Labs' count, 612.7 million USDT and 46.4 million TRX on the Tron blockchain came from the Binance hot wallet. The far larger TRX stash was therefore created only by swapping the stolen stablecoins.

Overhang in the market: how a known seller caps the price

An overhang is a large quantity of a token, known to the market, that is likely to be sold. The mechanism works in two directions. First, every actual sale pushes the price down because it meets an order book with limited buy-side depth. Second, merely knowing about the stash has an effect: anyone wanting to buy waits, expecting to get in more cheaply later. This second effect explains why a price also gives way on days when the holder moves nothing at all.

For TRX there is the added factor that the quantity is large relative to trading. With 95.02 billion tokens in circulation, 475 million is about half a percent of supply. Measured against daily volume of $1.39 billion, however, the stash corresponds to a substantial share of what is traded in a day at all.

Frozen or not: 378.7 million USDT blocked, zero for TRX

According to TRM Labs, Tether has frozen 378.7 million USDT in two of the attacker's wallets. That is not possible for TRX itself. The difference lies in the design: USDT is a token issued by a company whose contracts contain a freeze function. TRX is the native currency of the Tron blockchain; there is no issuer that could immobilise individual balances.

This very difference explains why the attacker swapped at all. Converting freezable stablecoins into tokens that cannot be frozen was the price he paid to secure his loot, and at $0.367 per TRX that price was well above the market price at the time.

From 575 million to 475 million TRX: just over 100 million tokens fewer

On October 30 we reported here on a 9 percent price slide and a stash of 575 million TRX held by the attacker. Elliptic's count now stands at about 475 million. Between the two readings lie just over 100 million tokens that have found their way into the market or to new addresses.

On October 30 the price was still above $0.33 and thus around the pre-incident level. Since then the $0.32 mark has fallen, as has $0.31. With a daily low of $0.3017, the round $0.30 mark has so far narrowly held.

Also new is the link to an older case: Elliptic has confirmed that part of the Tron funds was laundered together with proceeds from the attack on Bitget in September 2026. That points to the same infrastructure, not necessarily to the same perpetrators.

546 transfers: the loot's trail on the blockchain

The main address through which the attacker moves his TRX has sent 546 individual transfers since early on October 30, according to Elliptic's count. Between $38 million and $67 million in TRX has now left the addresses Elliptic is watching. The firm itself gives the range; it arises because not every onward transfer can be clearly attributed.

On October 30 the original roughly 638 million TRX were split across five new addresses. Over the same period Bitquery counted 15 freshly funded wallets that sold 8.9 million TRX for 3.1 million USDT early on October 30, while the largest single stash stayed put. According to Crypto Briefing, Whale Alert also reported a movement of 120 million TRX to an unknown address.

The pattern of many small transfers is typical of an attempt to make sales disappear into normal trading volume. For investors it is the second window to watch alongside the chart: as long as the large addresses keep selling in small steps, the supply pressure remains.

Levels on the daily chart: $0.30 as the line, $0.33 as the lid

The analysts cited by Coinpaper place support at $0.32, $0.31 and $0.30 and resistance at $0.33, $0.34 and $0.36. The two upper supports have since fallen. What remains is the $0.30 mark, which was almost reached with the daily low of $0.3017.

On the upside, it is striking that the first resistance at $0.33 lies exactly where the price stood before the attack. As long as TRX trades below it, the incident has not been recovered in arithmetic terms. Over seven days the price is down 5.98 percent, over 30 days 7.42 percent. According to Invezz, about 30 percent separates the price from its all-time high of $0.44 in December 2024.

There is no price target from a bank or broker. Invezz expressly notes that no major institution publishes a formal forecast for TRX. Anyone coming across specific targets online is reading model calculations by individual providers, not analyst estimates in the stock-market sense.

TRON Proposal 108: due on November 2 at 12:00 GMT

Regardless of the overhang, a network date is coming up. According to Invezz, the proposal numbered 108 is due to take effect on November 2 at 12:00 GMT, provided the Super Representatives approve it. The Super Representatives are the 27 elected nodes that confirm blocks on the Tron blockchain and vote on parameter changes.

The date falls in a phase in which the market reacts to every piece of network news anyway. If you hold TRX and watch the price that day, you should be able to tell the two causes apart: a vote on network parameters is something different from outflows from a known address.

Buying, leverage and custody under MiCA in Germany

When it comes to buying, since the EU's MiCA regulation took full effect in Germany, providers need a licence to offer crypto services. If you want to trade TRX, you will find the licensed options in our comparison of the best crypto exchanges; it also lists the fee models, which weigh more heavily for a token with a comparatively low unit price than for bitcoin.

On the holding period, the situation for private investors is unchanged: after one year a capital gain from crypto assets is tax-free in Germany, and below that the exemption limit for private sale transactions applies. Selling in a weak phase and buying back shortly afterwards resets the period for the new holding.

Those using leverage have the bigger problem in this situation. A move of five to nine percent in a day is enough to liquidate a position at ten times leverage, and an overhang produces exactly such days. If you use derivatives, you should know your provider's liquidation rules before the next such day comes.

On custody: the attack hit an exchange's hot wallet, not the Tron blockchain itself. For holders this says nothing about the security of their own tokens, but it does raise the familiar trade-off between availability on the exchange and managing your own keys. Binance has announced a full proof of reserves for Monday and cited a reserve of $6.34 billion; whether such a proof holds up depends on the audit method.

Editorial assessment: the overhang weighs more than the daily chart

In the editors' view, the most important figure in this article is not the daily loss but the difference between 638 million and 475 million TRX. It shows that the holder is actually selling, and it allows a rough estimate of the remaining pressure. Supporting this are the 546 transfers since October 30 and the $38 million to $67 million cited by Elliptic that has left the observed addresses. Against it is that nobody knows the pace of the coming days: according to Bitquery, the largest single stash was unmoved on October 30, and a holder wishing to avoid attention can pause for months.

What is assessed here is the situation, not the investment. We do not derive a buy or sell verdict from it, and the risk of total loss with crypto assets persists regardless of this specific question.

Tron overhang: Proposal 108 decides by November 2

Three things matter in the coming days:

1. The $0.30 level. It is the last of the supports cited by Coinpaper that is still holding; the daily low was $0.3017. If you trade with leverage, check the liquidation rules beforehand in our overview of perp DEX platforms.
2. The attacker's stash. If the 475 million cited by Elliptic keeps falling, supply pressure stays in the market; if it stays put, part of the burden falls away. If you reallocate in this phase, keep an eye on the holding period and document it with a tax tool or portfolio tracker.
3. The network date on November 2. Proposal 108 is due to take effect at 12:00 GMT. If you want to hold your own keys and take responsibility for movements yourself, compare the devices in the hardware wallet comparison.

Sources for further reading: Elliptic's continuously updated analysis of the incident and the market overview by Invezz of October 31.

(As of November 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)