Binance Hackers Shift to Swapping $46.4M in Solana for Bitcoin

Perpetrators behind the $6.3 billion theft from Binance have started exchanging stolen $SOL tokens for $BTC after largely clearing out intermediate wallets on Tron, according to blockchain analytics data ¹. Lookonchain reported on Sunday that the attackers transferred 486,970 SOL—worth approximately $46.4 million—and swapped the assets for Bitcoin using the cross-chain tool Relay ¹.

The maneuvers target capital that bypassed asset freezes enacted immediately following the breach, which stands as the largest heist in cryptocurrency history ¹. Stablecoin issuers Tether and Circle froze roughly $3 billion in stolen funds shortly after the attack, but independent researcher SomaXBT estimated that the hackers retain control of approximately $3.5 billion ¹. Binance stated that the incident compromised its hot wallets, with initial evidence indicating an employee laptop was breached before analysts found additional intrusion vectors ¹. Binance began reopening withdrawals on Sunday, committed to reimbursing losses, and confirmed coordination with US law enforcement agencies ¹.

Cross-Chain Laundering and Federal Alerts

Chainalysis stated on Sunday that temporary holding wallets on Tron were largely vacated as the attackers shifted operations toward Solana ¹. While Chainalysis recorded Tron transfers totaling roughly $500 million due to automated cyclical transactions, SomaXBT clarified that about $242 million net actually departed those specific Tron wallets ¹. The Federal Bureau of Investigation on Saturday formally attributed the intrusion to North Korean state-sponsored threat group TraderTraitor and published an advisory listing flagged wallet addresses ¹.

The FBI, alongside the US Secret Service and IRS Criminal Investigation, warned exchanges, THORChain node operators, and decentralized finance protocols to block addresses linked to the incident ¹. Investigators noted that prior phases involved converting assets into $ETH, while lookonchain identified around $250,000 sent to centralized exchange Gate across a 12-hour window on Monday ¹. Gate confirmed it subsequently froze two associated accounts ¹.

The movements come as on-chain observers monitor the laundering pipeline following initial tracing flags and earlier analyses of the exploit ¹. At the time of writing, Bitcoin traded at $77,662, while Solana changed hands at $93.92.