How to trace stolen USDT and TRX on TRON

· 3 min read · KadenaTrace

TRON carries more USDT than any other chain, and transfers there cost cents. That makes it a favorite route for stolen money, and also a place where part of it can still be stopped, because Tether can freeze USDT on TRON. This guide shows how to follow funds on TRON, using the TRON side of the Binance hack of October 28, 2026, recorded on Kadena as KT-18 and KT-19.

What is different about TRON

  • Addresses start with T and are 34 characters long, for example TSpe5HC3PRD2svJcr1YoGszhHk2mtkyZ8A, the first TRON address in KT-18.
  • Two kinds of transfer. TRX, the chain's own coin, moves in plain transfers. USDT is a token (TRC-20), and its transfers are calls to the USDT contract. Explorers list them on separate tabs; a trace has to read both.
  • Fees are paid in "energy" and "bandwidth", which an account gets by staking TRX or burns TRX to buy. A thief moving USDT needs TRX for fees, so the first move out of a drained wallet is often a small TRX transfer into it.
  • USDT can be frozen. Tether can block an address in the USDT contract. TRX cannot be frozen by anyone. A thief who knows this swaps USDT into TRX quickly. See USDT freezes.

Reading a transfer on Tronscan

Open the address on Tronscan. The "Transfers" tab shows TRX moves; the "TRC20 Transfers" tab shows USDT and other tokens. Each row has the transaction hash, the time, the other address and the amount. A swap on SunSwap or another DEX shows as tokens going to a contract and a different token coming back. KadenaTrace's trace reads both tabs, labels known contracts, and follows the money onward.

What the trace shows for the Binance hack on TRON

The attacker's two TRON addresses each became a case on Kadena, registered from public reports on October 30, 2026.

  • KT-18 started at TSpe5HC3…kyZ8A. As of October 31 it has more than 2,300 moves recorded on Kadena, and the trace follows the funds into more than 500 TRON wallets.
  • KT-19 started at TRBdWqHn…PRki, with more than 3,000 moves recorded, again spread across hundreds of wallets.

Two things stand out:

  1. Most of what moved was TRX, not USDT. Only the USDT could be frozen by Tether. Tether did freeze $312.7M in USDT at a third TRON address tied to the hack on October 29.
  2. The funds were split, wallet after wallet. Splitting into hundreds of wallets is how a thief makes freezes and manual tracing slow. The trace groups these splits so the page stays readable, and records each move on Kadena so nobody has to redo the work.

The trace reads the largest flows first, up to a limit. Where it stopped, the incident page says how much went to wallets it did not read, and totals are marked "at least".

While the USDT can still be frozen

If stolen USDT is sitting at an address on TRON, the window is short:

  1. Trace it now. Paste the address into Trace with the network set to TRON.
  2. Report the address to Tether with the transaction hashes and, if you have it, a police report number.
  3. Report to any exchange the trace shows a deposit to. See exchange deposits and freezes.
  4. Register the case so you are alerted when the funds move: Report a theft.

Mistakes to avoid on TRON

  • Reading only one tab. A wallet that "received nothing" on the TRX tab may have received millions in USDT on the TRC-20 tab.
  • Treating a fee top-up as the thief's own funds. A small TRX deposit into a drained wallet is usually just gas money for the next move.
  • Assuming a frozen address means the whole theft is frozen. In the Binance case, the TRX was never frozen.

The cases this guide follows

KT-18 and KT-19, the TRON side of the Binance hack reported on October 28, 2026; and Tether's $312.7M freeze on TRON. Figures are as recorded on October 31, 2026; the pages have the current state.

More guides