Binance Hackers Swap $46.4M in Stolen Solana Tokens for Bitcoin
Blockchain investigators say attackers behind the $6.3 billion Binance theft have shifted laundering activity from Tron to Solana, converting nearly 487,000 SOL into Bitcoin through Relay.
The attackers behind the $6.3 billion Binance theft have begun converting stolen Solana (SOL) tokens into Bitcoin (BTC), according to blockchain investigators. The shift follows a broad industry effort to freeze assets and disrupt the wallets used to move the stolen funds.
Hackers Move Nearly 487,000 SOL
Blockchain tracker Lookonchain reported that the attackers moved 486,970 SOL, valued at approximately $46.4 million, and swapped the tokens for Bitcoin through Relay. The activity involved funds that escaped freezes imposed after Thursday’s theft, described in the report as the largest in cryptocurrency history.
The laundering route has also involved Tron, where the hackers previously used temporary holding wallets. Chainalysis said most of those wallets had been emptied as the operation expanded to Solana. The company estimated that transfers connected to the Tron-based laundering activity reached roughly $500 million.
That figure includes repeated movements between wallets during the laundering process, according to investigator SomaXBT. He said approximately $242 million had actually left the Tron holding wallets, providing a lower estimate of funds transferred out of those addresses.
Freezes and Industry Response
Industry participants have moved to limit the attackers’ options. Tether and Circle froze approximately $3 billion in stolen assets, while SomaXBT estimated that the attackers still controlled about $3.5 billion.
Crypto exchange Gate said it froze two accounts linked to the activity. US investigators have also urged exchanges, decentralized finance services and infrastructure operators to block transactions involving the identified addresses or assets traced back to them.
The FBI, the US Secret Service and IRS Criminal Investigation specifically called on THORChain node operators, exchanges and DeFi platforms to take action. Investigators had observed the attackers converting stolen assets primarily into Ether (ETH) and expected additional laundering through DeFi applications and instant-swap services.
- Frozen by Tether and Circle: approximately $3 billion
- Estimated assets still controlled by attackers: approximately $3.5 billion
- SOL moved: 486,970 SOL, worth about $46.4 million
- Funds that left Tron holding wallets: approximately $242 million
What This Means
The move from Tron-based holding wallets to Solana and then into Bitcoin illustrates how quickly large-scale crypto thefts can migrate across chains and liquidity venues. For Solana, the activity places additional attention on cross-chain swaps, wallet screening and the ability of platforms such as Relay to respond to flagged funds.
The reported conversions do not indicate ordinary market selling, but they could create short-term liquidity and compliance concerns for venues handling the transactions. Continued freezes, address monitoring and coordination among exchanges, DeFi protocols and node operators will determine how much of the remaining funds can be moved or converted.