Binance hackers shift stolen Solana tokens into Bitcoin as laundering enters new phase
The hackers behind the $6.3 billion theft from Binance have started converting stolen Solana tokens into Bitcoin, according to blockchain investigators. Solana (SOL) is a cryptocurrency used for payments and applications on its own blockchain, a shared public record of transactions.
Blockchain research firm Chainalysis said Sunday that most of the hackers' temporary holding wallets on Tron, another blockchain network, had been emptied as the laundering moved to Solana. Laundering means moving stolen money through many transactions to hide where it came from.
Thursday's theft is described as the largest in cryptocurrency history. Industry partners, including stablecoin issuers Tether and Circle, froze about $3 billion in stolen assets. Stablecoins are cryptocurrencies designed to hold a steady value, often pegged to the US dollar. Investigator SomaXBT estimated the attackers still controlled about $3.5 billion.
Key points in the laundering shift
- Lookonchain reported Sunday that the hackers moved 486,970 Solana tokens, worth about $46.4 million, and were swapping them for Bitcoin through the Relay service.
- Chainalysis put the value of the Tron transfers at about $500 million.
- SomaXBT said that figure included repeated movements between wallets, and that about $242 million actually left the Tron holding wallets.
- Lookonchain reported Monday that about $250,000 in stolen funds reached centralized exchange Gate over the preceding 12 hours. A centralized exchange is a company-run platform for trading crypto.
- Gate said it froze two linked accounts and would cooperate with law enforcement. It did not say how much money was frozen.
What Binance has said about the breach
Binance said the attack compromised its hot wallets, which are internet-connected wallets used for handling customer withdrawals. Early findings pointed to a hacked employee laptop, but investigators later identified additional breach points.
The exchange began restoring withdrawals Sunday, pledged to cover the losses, and said it has been working with US authorities to trace and recover the stolen assets.
FBI attributes the theft to TraderTraitor
On Saturday, the FBI attributed the theft to North Korea's TraderTraitor hackers and published wallet addresses linked to the stolen assets.
The FBI, the US Secret Service, and IRS Criminal Investigation urged THORChain node operators, exchanges, and decentralized finance (DeFi) services to block transactions involving those addresses or funds traced back to them. DeFi services are software-based platforms that let users swap crypto without a central company.
Investigators had observed the hackers converting stolen assets primarily into Ether (ETH), the cryptocurrency of the Ethereum network. The FBI said it expected further laundering through DeFi and instant swap services.
Signs of automated money movement
Chainalysis said Friday that the hackers may be using automation to obscure the trail. It cited thousands of transactions in a short period and observed funds circulating repeatedly between wallets, sometimes returning to addresses used earlier in the sequence.
What is confirmed
- Binance suffered a $6.3 billion theft on Thursday in which its hot wallets were compromised, according to the exchange.
- The FBI attributed the attack to North Korea's TraderTraitor group and published related wallet addresses.
- Chainalysis reported that Tron holding wallets were largely emptied and laundering moved to Solana.
- Gate froze two linked accounts after stolen funds were deposited there, according to the exchange.
- Binance began restoring withdrawals Sunday and pledged to cover the losses.
Where the numbers differ
Chainalysis valued the Tron transfers at about $500 million. SomaXBT said that figure counted repeated movements between wallets and that about $242 million actually left the Tron holding wallets. The exact amount of stolen funds the hackers still control also rests on SomaXBT's estimate of about $3.5 billion, alongside the roughly $3 billion frozen by industry partners.
Why this matters
The theft is the largest in cryptocurrency history, and much of the stolen money remains outside the freezes. US agencies are asking exchanges and DeFi services to block specific addresses, so further swaps into Bitcoin or other assets may be harder to stop once funds reach platforms that do not follow the request. Binance covering the losses affects how its customers are made whole.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
