Binance hackers swap $46 million in Solana for Bitcoin

Hackers behind the $6.3 billion theft from Binance moved 486,970 Solana (SOL) tokens worth about $46.4 million and began exchanging them for Bitcoin (BTC) through Relay, according to blockchain investigators. The transfers followed the near-emptying of temporary wallets used to move stolen funds on the Tron network.

The transactions involved assets that escaped freezes imposed after Thursday’s theft, which has been described as the largest in cryptocurrency history. Tether and Circle froze about $3 billion in stolen assets. Investigator SomaXBT estimated that the attackers still controlled about $3.5 billion.

Blockchain data showed the hackers moving funds from Tron to Solana. Chainalysis valued the Tron-related transfers at about $500 million. SomaXBT said that total included repeated transfers between wallets and estimated that about $242 million had actually left the Tron holding wallets.

Chainalysis reported that the hackers may have used automated systems to make the funds harder to trace. Investigators recorded thousands of transactions over a short period. Funds moved repeatedly between wallets and sometimes returned to addresses used earlier in the process.

Some stolen funds reached Gate, a centralized cryptocurrency exchange. Blockchain monitoring data showed deposits of about $250,000 during the 12 hours before Monday. Gate confirmed that it had frozen two linked accounts and would cooperate with law enforcement. The exchange did not disclose how much money was held in those accounts.

The FBI attributed Thursday’s theft on Saturday to North Korea’s TraderTraitor hacking group and published wallet addresses linked to the stolen assets. The FBI, the US Secret Service and the IRS Criminal Investigation division urged cryptocurrency exchanges, THORChain node operators and decentralized finance services to block transactions involving those addresses or funds traced to them.

The FBI reported that the hackers had mainly converted stolen assets into Ether (ETH) and could continue laundering funds through decentralized finance platforms and instant-swap services. The transfers into Solana and Bitcoin added another stage to the movement of funds across blockchain networks.

Binance reported that the attack compromised its hot wallets, which hold cryptocurrency for routine transactions. The exchange’s initial findings pointed to a hacked employee laptop, while later investigations identified additional breach points.

Binance began restoring withdrawals on Sunday and pledged to cover the losses. The exchange is working with US authorities and industry partners to trace and recover the stolen assets.