MistTrack Links Binance Theft Route to Phemex-Connected Address

Crypto-tracking platform MistTrack said $TRX stolen from Binance moved through Bitget Wallet’s swap bridge to an Ethereum address connected to the Phemex theft, identifying an overlap between the two transaction trails.

TronScan records corroborate three successive wallet-to-wallet hops in the route MistTrack published. The final Tron wallet sent about **317,093 $TRX** into a swap router across 10 successful calls, according to The Defiant’s calculation. Ethereum records show the destination receiving $ETH from contracts labeled Bitget DEX Aggregator and Bitget Swap 2.

The finding connects the Binance fund movements to a transaction history MistTrack associates with Phemex, giving investigators another trail to examine. It does not, by itself, establish that the same person or group carried out both thefts, or whether the shared recipient is an attacker-controlled wallet or an intermediary.

“We found that the destination address had previously been used by the Phemex hacker,” MistTrack wrote. The tracker published both address sequences and linked a Bitget Bridge order.

The Tron route began with a transfer of approximately **46.38 million $TRX** from the wallet MistTrack identified as the Binance hacker’s starting address. Smaller batches subsequently moved through the next wallets. The 317,093 $TRX figure measures native-token inputs to the final wallet’s swap router, not the total stolen from Binance.

A Transfer Link, Not an Identity

On Ethereum, the shared destination received **13.61 $ETH** from the penultimate wallet in MistTrack’s Phemex-side sequence before receiving the Bitget-labeled payouts. The published Phemex path spans several transfers and dates: one connection between its upstream wallets was a 0.004 $ETH transfer in December 2025. Those transfers establish connections between addresses, not the identity of their operators.

The trace follows a broader Binance security incident that the exchange estimated at around $6.3 billion. Binance said approximately $3 billion in affected assets had been frozen onchain and that it would cover all losses using its SAFU emergency fund and company funds.

The shared Ethereum recipient had already sent funds onward: its transaction history records a **23.51 $ETH** outgoing transfer after the latest Bitget-labeled receipt shown in the records.