Binance theft laundering shifts to Solana-to-Bitcoin swaps as investigators track funds

Traders Union
All News
Crypto
Binance theft laundering shifts

Highlights

Hackers behind Binance’s $6.3 billion theft shifted 486,970 Solana tokens ($46.4 million) for laundering into Bitcoin via Relay after Tron wallets were emptied.
Industry actors including Tether and Circle froze about $3 billion of assets, while hackers retain control of about $3.5 billion despite tighter tracing.
Gate froze two accounts receiving $250,000 in stolen funds after the FBI attributed the attack to North Korea’s TraderTraitor group and warned exchanges to block linked transactions.

Solana swaps expand laundering route

As reported by Cointelegraph, citing Chainalysis, the hackers behind Binance’s $6.3 billion theft have largely emptied the temporary Tron wallets used to launder funds and have begun shifting activity into Solana, where stolen tokens are being swapped for Bitcoin through Relay.

Lookonchain said on Sunday that the attackers moved 486,970 Solana tokens, worth about $46.4 million, in transactions tied to the laundering effort. The activity involves funds that avoided the freezes imposed after Thursday’s theft, which is described as the largest in cryptocurrency history.

Industry partners including Tether and Circle froze about $3 billion in stolen assets, while investigator SomaXBT estimated the attackers still control roughly $3.5 billion. Chainalysis said the value of Tron transfers was about $500 million, although SomaXBT said that figure includes repeated movements between wallets and that about $242 million actually left the Tron holding wallets.

Chainalysis also said on Friday that the hackers may be using automation to hide the trail, citing thousands of transactions completed in a short period. The firm said funds are circulating repeatedly between wallets, sometimes returning to addresses already used earlier in the sequence.

Exchange response and U.S. enforcement pressure

Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop before investigators later identified additional breach points. The exchange began restoring withdrawals on Sunday, said it would cover the losses, and has been working with U.S. authorities to trace and recover the stolen assets.

Some of the stolen funds also reached centralized exchange Gate. Lookonchain reported on Monday that the hackers had deposited about $250,000 there over the previous 12 hours, and Gate later said it froze two linked accounts and would cooperate with law enforcement, without specifying the amount frozen.

The FBI said on Saturday that North Korea’s TraderTraitor hackers are responsible for Thursday’s theft and published wallet addresses linked to the stolen assets. The agency, the U.S. Secret Service, and IRS Criminal Investigation urged THORChain node operators, exchanges, and decentralized finance services to block transactions involving those addresses or any funds traced back to them.

The FBI said investigators had mainly seen the stolen assets being converted into Ether and expected further laundering through DeFi platforms and instant swap services. The shift into Solana-to-Bitcoin swaps suggests the laundering effort is adapting as freezes and tracking measures tighten across the crypto sector.

In our earlier article on rising cybersecurity funding and consolidation, we highlighted how investor demand stayed strong as large late-stage rounds pushed total quarterly funding higher despite fewer deals. We also noted that AI-driven and identity-security firms attracted much of the capital, alongside major acquisitions aimed at strengthening fraud detection and risk controls.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.