The attackers behind the $6.3B Binance theft have started converting stolen Solana tokens into Bitcoin after largely emptying their Tron holding wallets, blockchain investigators say. The funds that escaped the freezes imposed after Thursday's theft are now entering a new laundering phase.
What happened on Solana
Chainalysis said on Sunday that most of the hackers' temporary holding wallets on Tron had been emptied as laundering expanded to Solana. The firm put the value of the Tron transfers at about $500M.
Lookonchain reported on Sunday that the hackers had moved 486,970 SOL, worth about $46.4M, and were swapping it for BTC through Relay.
Investigator SomaXBT said the $500M figure counts repeated movements between wallets. About $242M actually left the Tron holding wallets, by his count.
Automation and thousands of transactions
On Friday, Chainalysis said the hackers may be using automation to obscure the trail, citing thousands of transactions in a short period.
Funds circulated repeatedly between wallets, sometimes returning to addresses used earlier in the sequence.
Gate freezes two accounts
Some of the funds reached centralized exchange Gate. Lookonchain reported on Monday that the hackers had deposited about $250,000 there over the preceding 12 hours.
Gate said it had frozen two linked accounts and would cooperate with law enforcement. The statement did not specify how much was frozen.
Where the money is
Category | Amount |
|---|---|
Total stolen (Thursday) | $6.3B |
Frozen by Tether, Circle and other partners | about $3B |
Still controlled by attackers (SomaXBT estimate) | about $3.5B |
Tron transfers (gross, Chainalysis) | about $500M |
Net outflows from Tron wallets (SomaXBT) | about $242M |
SOL moved toward BTC via Relay | about $46.4M |
FBI asks services to block the transactions
The FBI on Saturday attributed the theft to North Korea's TraderTraitor group and published wallet addresses linked to the stolen assets.
- The FBI, US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and DeFi services to block transactions involving those addresses
- The request also covers funds traced back to the published addresses
- The FBI observed conversions mainly into ETH and expects further laundering through DeFi and instant swap services
What Binance said
Binance confirmed the attack compromised its hot wallets. Early findings pointed to a hacked employee laptop before investigators identified additional breach points.
The exchange began restoring withdrawals on Sunday, pledged to cover the losses and is working with US authorities to trace and recover the stolen assets.