Hackers linked to the record Binance theft have started converting stolen Solana tokens into Bitcoin after largely draining the Tron wallets used for laundering, Cointelegraph reported Monday.
Blockchain investigator Lookonchain said Sunday that the attackers moved 486,970 SOL, worth roughly $46.4 million, and began swapping the tokens for BTC through Relay.
The activity involves funds that escaped freezes imposed after Thursday’s $6.3 billion theft, the largest in cryptocurrency history.
Industry partners including Tether and Circle froze about $3 billion in stolen assets, while investigator SomaXBT estimated the attackers still controlled roughly $3.5 billion.
Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop before investigators identified additional breach points.
The exchange began restoring withdrawals Sunday, pledged to cover the losses, and has been working with U.S. authorities to trace and recover the stolen assets.
Chainalysis said Sunday that most of the hackers’ temporary holding wallets on Tron had been emptied as laundering expanded to Solana, putting the value of the Tron transfers at about $500 million.
SomaXBT clarified that the $500 million figure counted repeated movements between wallets during laundering, and that about $242 million actually left the Tron holding wallets.
Chainalysis noted Friday that the hackers may be using automation to obscure the trail, citing thousands of transactions in a short period.
The firm observed funds circulating repeatedly between wallets, sometimes returning to addresses used earlier in the sequence.
Some stolen funds also reached the centralized exchange Gate.
Lookonchain reported Monday that the hackers had deposited about $250,000 there over the preceding 12 hours.
Gate subsequently said it had frozen two linked accounts and would cooperate with law enforcement, though its statement did not specify the amount frozen.
The FBI on Saturday attributed Thursday’s theft to North Korea’s TraderTraitor hackers and published wallet addresses linked to the stolen assets.
The agency, along with the U.S. Secret Service and IRS Criminal Investigation, urged THORChain node operators, exchanges, and DeFi services to block transactions involving those addresses or funds traced back to them.
Investigators had observed the hackers converting stolen assets primarily into Ether and expected further laundering through DeFi and instant swap services, the FBI said.
