Binance’s $6.3B heist turns into a crypto shell game as stolen SOL heads toward $BTC

The hackers behind Binance’s $6.3 billion theft have begun swapping stolen Solana (SOL) tokens for Bitcoin ($BTC) through Relay, blockchain investigators said, as most of the temporary holding wallets on Tron were emptied. The theft, which occurred Thursday, was the largest in cryptocurrency history. Lookonchain reported Sunday that the hackers moved 486,970 Solana (SOL), worth about $46.4 million, in the swaps.

Industry partners Tether and Circle froze about $3 billion in stolen assets, while investigator SomaXBT estimated that the attackers still controlled about $3.5 billion. Chainalysis said the value of the Tron transfers during laundering was about $500 million, although SomaXBT said about $242 million actually left the Tron holding wallets. The $500 million figure included repeated transfers between wallets, with some funds returning to addresses used earlier in the sequence. Chainalysis said hackers may be using automation to obscure the trail, citing thousands of transactions in a short period.

Some stolen funds also reached centralized exchange Gate. Lookonchain reported Monday that the hackers deposited about $250,000 there over the preceding 12 hours. Gate subsequently froze two linked accounts and said it would cooperate with law enforcement, without specifying how much money was frozen.

Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop before investigators identified additional breach points. The exchange began restoring withdrawals Sunday, pledged to cover the losses and has been working with US authorities to trace and recover the stolen assets. The FBI on Saturday attributed Thursday’s theft to North Korea’s TraderTraitor hackers and published wallet addresses linked to the stolen assets. The agency, US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and decentralized finance (DeFi) services to block transactions involving those addresses or funds traced back to them. Investigators had observed the hackers converting stolen assets primarily into Ether ($ETH) and expected further laundering through DeFi and instant swap services, the FBI said.