Attackers initially swapped 234 million stolen USDT for TRX on SunSwap, using approximately 7,700 TRON network addresses before moving funds off TRON.