Hackers behind the $6.3 billion theft from Binance have started converting stolen Solana tokens into Bitcoin, according to blockchain investigators. The activity followed the movement of funds through wallets previously used to launder assets on the Tron network.
Lookonchain reported that the attackers moved 486,970 SOL, valued at approximately $46.4 million, and were swapping the tokens for Bitcoin through Relay. Chainalysis said most of the temporary holding wallets used on Tron had been emptied as the laundering operation expanded to Solana.
Chainalysis estimated the value of transfers involving the Tron wallets at around $500 million. SomaXBT clarified that this figure included repeated movements between wallets, while approximately $242 million had actually left the holding wallets. Chainalysis also said the hackers may be using automation to conceal the flow of funds, with thousands of transactions and repeated transfers between addresses.
The theft, which occurred Thursday, was described as the largest in cryptocurrency history. Tether and Circle froze around $3 billion in stolen assets, while SomaXBT estimated that the attackers still controlled approximately $3.5 billion. Binance said its hot wallets had been compromised and that early findings pointed to a hacked employee laptop before investigators identified additional breach points. The exchange began restoring withdrawals, pledged to cover the losses and said it was working with US authorities to recover the funds.
Some of the stolen assets also reached the centralized exchange Gate. Lookonchain said the hackers deposited about $250,000 there over a 12-hour period. Gate later announced that it had frozen two related accounts and would cooperate with law enforcement, without specifying the amount frozen.
The FBI attributed the theft to North Korea’s TraderTraitor hackers and published wallet addresses associated with the stolen assets. The FBI, the US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and decentralized finance services to block transactions involving those addresses or funds traced to them.
According to the FBI, the attackers had initially converted much of the stolen cryptocurrency into Ether and were expected to continue laundering funds through decentralized finance platforms and instant swap services.
Sources: Cointelegraph.