Hackers Behind $6.3 Billion Binance Heist Shift to Bitcoin After Draining Tron Wallets

Lookonchain reported on Sunday that the hackers transferred 486,970 Solana (SOL) tokens valued at approximately $46.4 million and were swapping them for Bitcoin (BTC) using the Relay platform.

These transactions involve assets that were not frozen after last Thursday’s massive theft—the largest in cryptocurrency history. Industry partners such as Tether and Circle froze roughly $3 billion of the stolen assets, while research group SomaXBT estimated the attackers still control about $3.5 billion.

Binance confirmed that the breach affected its hot wallets, initially traced to a compromised employee laptop before investigators uncovered additional security failures. The exchange resumed withdrawals on Sunday, pledged to cover losses, and is working with U.S. authorities to trace and recover the stolen funds.

Chainalysis stated on Sunday that most of the hackers’ temporary wallets on Tron had been depleted as laundering operations expanded onto the Solana blockchain. The company estimated that transfers on Tron totaled around $500 million.

According to SomaXBT, this $500 million figure includes transfers during laundering processes, such as repeated movements between wallets; about $242 million actually left the Tron wallets.

Chainalysis noted on Friday that the hackers likely used automation to disguise their activities, with thousands of transactions occurring over a brief time span. The firm observed funds cycling repeatedly between wallets, sometimes returning to earlier-used addresses within the sequence.

Some of the stolen assets were also funneled into the centralized exchange Gate. Lookonchain reported on Monday that approximately $250,000 had been deposited there within the prior 12 hours.

Gate announced it had frozen two related accounts and would cooperate with law enforcement, though it did not specify the amount frozen.

On Saturday, the FBI attributed the theft to North Korea’s TraderTraitor hacker group and released wallet addresses linked to the stolen assets.

The FBI, U.S. Secret Service, and IRS Criminal Investigation urged THORChain node operators, exchanges, and decentralized finance (DeFi) platforms to block transactions involving the specified addresses or funds traced to them.

Investigators observed the hackers mainly converting the stolen assets into Ether (ETH) and anticipated further laundering through DeFi protocols and instant swap services, according to the FBI.

why

This ongoing laundering operation highlights the complexities of tracking stolen cryptocurrency on multiple blockchains and the importance of coordinated efforts among exchanges, investigators, and law enforcement to mitigate such large-scale cybercrime.