--- title: "Binance Hackers Shift to Swapping $46.4M in Solana for Bitcoin" description: "Attackers moved 486,970 SOL through cross-chain bridge Relay after laundering funds across Tron, Chainalysis and Lookonchain reported." url: https://basisdesk.news/news/binance-hackers-swap-solana-for-bitcoin-chainalysis published: 2026-11-02T13:11:38.688Z modified: 2026-11-02T13:11:38.688Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [SOL, BTC, ETH] tags: [Binance, hack, Solana, Bitcoin, Chainalysis, North Korea, TraderTraitor, FBI] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Binance Hackers Shift to Swapping $46.4M in Solana for Bitcoin Attackers moved 486,970 SOL through cross-chain bridge Relay after laundering funds across Tron, Chainalysis and Lookonchain reported. ## At a glance - **What happened:** Hackers who breached Binance swapped 486,970 SOL ($46.4M) for Bitcoin through Relay after emptying Tron holding wallets, Lookonchain reported. - **Why it matters:** The attackers still control an estimated $3.5 billion in unencumbered stolen crypto following roughly $3 billion in freezes by Tether and Circle. - **Who is affected:** Binance, Gate, THORChain node operators, and decentralized bridge protocols handling cross-chain transfers. - **What's next:** US agencies are tracking transaction flows and requesting centralized and decentralized venues block flagged TraderTraitor wallet addresses. - **Status:** enforcement - **Primary source:** [Binance hackers begin swapping stolen Solana tokens for Bitcoin: Chainalysis](https://cointelegraph.com/news/binance-hackers-solana-new-phase-laundering-chainalysis?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com ## Key points - Hackers moved 486,970 SOL ($46.4 million) to swap for Bitcoin via Relay after vacating Tron holding addresses. - The FBI formally attributed the $6.3 billion Binance heist to North Korea's TraderTraitor group, urging DeFi protocols and exchanges to freeze linked funds. - Tether and Circle froze roughly $3 billion, while an estimated $3.5 billion remains under the attackers' control. ## Editorial remark - **Context:** The breach of Binance hot wallets resulted in the theft of $6.3 billion, triggering rapid asset freezes by centralized stablecoin issuers while the perpetrators deployed automated routing across Tron, Ethereum, and Solana. - **Impact:** Exchanges and cross-chain bridges face intense federal scrutiny to blacklist North Korean-linked addresses, while Binance works to restore withdrawal infrastructure and cover customer balances. - **Watch:** Monitoring on-chain laundering routes, potential THORChain and bridge blacklisting compliance, and further account freezes across centralized exchanges. Perpetrators behind the $6.3 billion theft from Binance have started exchanging stolen $SOL tokens for $BTC after largely clearing out intermediate wallets on Tron, according to blockchain analytics data [1]. Lookonchain reported on Sunday that the attackers transferred 486,970 SOL—worth approximately $46.4 million—and swapped the assets for Bitcoin using the cross-chain tool Relay [1]. The maneuvers target capital that bypassed asset freezes enacted immediately following the breach, which stands as the largest heist in cryptocurrency history [1]. Stablecoin issuers Tether and Circle froze roughly $3 billion in stolen funds shortly after the attack, but independent researcher SomaXBT estimated that the hackers retain control of approximately $3.5 billion [1]. Binance stated that the incident compromised its hot wallets, with initial evidence indicating an employee laptop was breached before analysts found additional intrusion vectors [1]. Binance began reopening withdrawals on Sunday, committed to reimbursing losses, and confirmed coordination with US law enforcement agencies [1]. ## Cross-Chain Laundering and Federal Alerts Chainalysis stated on Sunday that temporary holding wallets on Tron were largely vacated as the attackers shifted operations toward Solana [1]. While Chainalysis recorded Tron transfers totaling roughly $500 million due to automated cyclical transactions, SomaXBT clarified that about $242 million net actually departed those specific Tron wallets [1]. The Federal Bureau of Investigation on Saturday formally attributed the intrusion to North Korean state-sponsored threat group TraderTraitor and published an advisory listing flagged wallet addresses [1]. The FBI, alongside the US Secret Service and IRS Criminal Investigation, warned exchanges, THORChain node operators, and decentralized finance protocols to block addresses linked to the incident [1]. Investigators noted that prior phases involved converting assets into $ETH, while lookonchain identified around $250,000 sent to centralized exchange Gate across a 12-hour window on Monday [1]. Gate confirmed it subsequently froze two associated accounts [1]. The movements come as on-chain observers monitor the laundering pipeline following initial [tracing flags](https://basisdesk.news/news/elliptic-flags-first-bitcoin-mixing-binance-hack) and [earlier analyses of the exploit](https://basisdesk.news/analysis/north-korea-steals-billions-from-binance) [1]. At the time of writing, Bitcoin traded at $77,662, while Solana changed hands at $93.92. ## Sources 1. [Binance hackers begin swapping stolen Solana tokens for Bitcoin: Chainalysis](https://cointelegraph.com/news/binance-hackers-solana-new-phase-laundering-chainalysis?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com, 2026-11-02 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai