Binance hackers swap $46.4M in stolen Solana for Bitcoin via Relay

The stolen crypto keeps moving. Lookonchain reported Sunday that hackers tied to the $6.3 billion Binance theft shifted 486,970 Solana tokens — roughly $46.4 million — and began swapping them for Bitcoin through Relay. The move came after they had mostly drained the wallets used to launder funds on Tron, according to blockchain investigators.

Thursday's heist is the biggest in crypto history. Tether and Circle froze about $3 billion in stolen assets, but investigator SomaXBT estimated the attackers still held around $3.5 billion. The coins now moving are the ones that slipped past those freezes.

Binance said the attack hit its hot wallets. Early findings pointed to a hacked employee laptop, and investigators later found additional breach points. The exchange started restoring withdrawals Sunday, promised to cover the losses and is working with US authorities to trace the money. Binance outflows topped $7 billion, while rival OKX pulled in $445 million in net inflows.

Chainalysis said Sunday that most of the hackers' temporary Tron holding wallets had been emptied as laundering spread to Solana, putting the Tron transfers at about $500 million. SomaXBT pushed back, saying that figure counted repeated movements between wallets and that only about $242 million actually left the Tron wallets. Chainalysis also flagged signs of automation, citing thousands of transactions in a short window as funds cycled between addresses.

Some of the loot reached Gate. Lookonchain said Monday the hackers deposited about $250,000 there over the previous 12 hours; Gate froze two linked accounts and said it would cooperate with law enforcement, without saying how much was locked. On Saturday, the FBI blamed North Korea's TraderTraitor crew, published wallet addresses tied to the stolen assets and joined the Secret Service and IRS Criminal Investigation in urging THORChain node operators, exchanges and DeFi services to block those funds. Investigators said the hackers had been converting mainly into Ether and expected more laundering through DeFi and instant swap services.