Binance hackers convert stolen Solana into Bitcoin

Binance hackers convert stolen Solana into Bitcoin
How hackers are laundering funds stolen from Binance

​Hackers who stole $6.3 billion from Binance have begun swapping stolen Solana tokens for Bitcoin. Meanwhile, most of the funds have already been moved out of wallets on the Tron network that the attackers used to conceal the trail of the largest cryptocurrency theft in history.

According to blockchain analytics platform Lookonchain, the attackers transferred 486,970 SOL worth approximately $46.4 million on November 1 and began converting the tokens into Bitcoin through Relay.

The transactions involve funds that escaped the freezes imposed after the October 29 Binance hack. Tether, Circle, and other crypto industry participants have frozen approximately $3 billion in stolen assets. However, blockchain investigator SomaXBT estimates that the hackers still control around $3.5 billion.

Binance previously reported that its hot wallets had been compromised in the attack. Initial findings pointed to a hacked employee laptop, but investigators later identified additional points of intrusion.

On Sunday, the exchange began gradually restoring withdrawals. The company also pledged to cover the losses and continued working with U.S. law enforcement agencies to trace and recover the stolen assets.

How hackers are trying to conceal fund movements

Blockchain analytics firm Chainalysis reported that the attackers had nearly emptied their temporary holding wallets on the Tron network while expanding their laundering operations to Solana. Analysts estimated the total value of transfers through Tron at approximately $500 million.

However, SomaXBT clarified that this figure included repeated transfers of the same assets between different addresses. According to his calculations, only about $242 million actually left the intermediate Tron wallets.

On October 30, Chainalysis highlighted an unusual pattern of transactions. The hackers carried out thousands of transfers in a short period, repeatedly moving funds between different addresses. In some cases, assets returned to wallets that had already been used earlier.

Analysts believe the attackers may be using automated tools to obscure transaction trails and make stolen cryptocurrency more difficult to trace.

FBI calls for blocking hackers' transactions

Some of the stolen assets also reached the centralized cryptocurrency exchange Gate. According to Lookonchain, which published its findings on November 2, the attackers deposited approximately $250,000 on the platform over the preceding 12 hours.

In response, Gate announced that it had frozen two accounts linked to the suspicious transactions and was prepared to cooperate with law enforcement authorities. However, the exchange did not disclose the amount of funds frozen.

Meanwhile, on October 31, the U.S. Federal Bureau of Investigation (FBI) officially attributed the Binance hack to North Korea's TraderTraitor hacking group. The agency also published cryptocurrency wallet addresses linked to the stolen assets.

The FBI, together with the U.S. Secret Service and the Internal Revenue Service Criminal Investigation (IRS-CI), urged cryptocurrency exchanges, THORChain node operators, and decentralized finance (DeFi) platforms to block transactions involving the identified addresses and stolen funds.

According to U.S. investigators, the hackers initially converted stolen assets primarily into Ether (ETH). The FBI expects the attackers to continue attempting to conceal the origin of the funds through DeFi protocols and instant cryptocurrency swap services.

Largest hack in cryptocurrency history

The October 29 attack on Binance became the largest cryptocurrency theft in history. According to the exchange, hackers stole approximately $6.3 billion, more than four times the previous record set during the Bybit hack in February 2025. In that incident, attackers stole around $1.5 billion worth of Ether from the exchange.

Another major incident was the hack of the Ronin blockchain network, associated with the game Axie Infinity. In March 2022, hackers stole approximately $620 million in assets after gaining control of validator keys. In August 2021, more than $610 million was drained from the Poly Network protocol, although the attacker subsequently returned almost all the funds.

Another major attack targeted Japanese cryptocurrency exchange Coincheck in January 2018, when approximately $530 million worth of tokens was stolen. In 2014, Mt. Gox, then the world's largest Bitcoin exchange, collapsed following years of Bitcoin thefts worth around $500 million.

As a reminder, Binance customers withdrew $5.8 billion from the exchange.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.