Hackers responsible for Binance’s estimated $6.3 billion theft have started shifting parts of the stolen cryptocurrency into new routes for laundering, according to blockchain investigators tracking on-chain movements. As freezes disrupt activity across multiple networks, investigators say the group has begun converting large quantities of stolen Solana (SOL) into Bitcoin (BTC).

Lookonchain reported Sunday that the attackers moved 486,970 SOL—valued at roughly $46.4 million at the time of reporting—by swapping through Relay. The shift follows an earlier pattern in which investigators said the laundering wallets used on Tron were largely emptied after assets were targeted with exchange and issuer freezes.

Key takeaways

Lookonchain said hackers moved 486,970 SOL (about $46.4 million) and swapped it for BTC via Relay.
Blockchain data cited in the reports suggests most Tron temporary holding wallets were largely drained, with laundering expanding to Solana.
Chainalysis previously described laundering patterns that may involve automation, repeated wallet transfers, and transactions cycling back through addresses.
The FBI attributed the theft to North Korea-linked TraderTraitor hackers and urged crypto services—including DeFi—to block transactions tied to listed wallet addresses.
Gate said it froze two linked accounts tied to the stolen funds but did not disclose the amount frozen.

Solana-to-Bitcoin swaps emerge as freezes bite

The latest movement centers on a portion of stolen funds that appears to have escaped some of the restrictions imposed after the Thursday hack. Earlier, investigators and industry participants said roughly $3 billion in stolen assets were frozen, including action by issuers and partners such as Tether and Circle.

Lookonchain’s Sunday update claims that the hackers are now converting SOL into BTC through Relay. The use of an intermediary swapping service suggests the attackers are not merely moving assets between wallets, but actively seeking conversion paths that can help preserve liquidity once certain tokens are frozen.

While the swap indicates a tactical shift, other investigators estimate the group still holds substantial value. SomaXBT, for instance, estimated that the attackers retained about $3.5 billion after the freezes, underscoring that the laundering effort was not fully contained by countermeasures.

Tron wallets largely emptied; laundering patterns expand

Chainalysis said Sunday that the hackers’ temporary holding wallets on Tron had largely been emptied as laundering activity moved onto Solana. In its accounting, Chainalysis put the value of the Tron transfers connected to the laundering process at roughly $500 million.

However, SomaXBT later clarified that the $500 million figure included repeated movements and internal transfers between wallets. In that view, only about $242 million actually left the Tron holding wallets, meaning investigators’ totals may reflect both outbound value and the “churn” used to obscure trails.

Chainalysis also reported earlier on Friday that hackers may have used automation: it observed thousands of transactions occurring quickly and funds moving repeatedly between wallets. The firm noted that some transfers appeared to return to addresses used earlier in the laundering sequence—an indicator of highly structured activity rather than a simple, linear withdrawal.

Centralized exchange alerts: Gate freezes linked accounts

The laundering network also intersected with centralized exchanges. Lookonchain reported Monday that hackers deposited about $250,000 to Gate over the prior 12 hours. Gate subsequently said it froze two linked accounts and would cooperate with law enforcement, though it did not specify how much was frozen.

For affected users, exchange-linked freezes can be a double-edged development. On one hand, freezing linked accounts can interrupt the attackers’ ability to cash out. On the other, it can take time to reconcile which withdrawals are legitimate and which funds remain blocked—especially when attackers have already moved assets through multiple hops.

Binance, for its part, said its hot wallets were compromised, with early findings pointing to a hacked employee laptop before investigators identified additional breach points. The exchange began restoring withdrawals Sunday, pledged to cover losses, and said it was working with US authorities to trace and recover stolen assets.

FBI directive targets specific wallet activity across crypto services

Beyond on-chain tracking by firms, the US government moved to disrupt laundering through direct guidance to the industry. The FBI attributed Thursday’s theft to North Korea’s TraderTraitor hackers and published wallet addresses it linked to the stolen funds.

In an advisory issued on Saturday, the FBI—along with the US Secret Service and IRS Criminal Investigation—urged THORChain node operators, exchanges, and decentralized finance services to block transactions involving those addresses or funds traced back to them. The FBI said investigators observed the hackers converting stolen assets primarily into Ether (ETH) and expected further laundering through DeFi and instant swap services.

This kind of directive matters because laundering at scale often depends on liquidity across multiple venues—bridges, swaps, and DeFi pools—where blocking even a small set of addresses can reduce the attackers’ ability to consolidate value quickly. It also raises practical questions for service operators: how they screen incoming transactions, how quickly filters update, and how to avoid collateral restrictions on unrelated users.

As Binance restores withdrawals and more custodians implement account freezes, the next critical development is whether the attackers’ conversions and swap activity can be slowed across Solana-to-Bitcoin routes and other liquidity rails flagged by investigators. Readers should watch for additional on-chain reporting of how much value remains unfrozen, and whether subsequent government or exchange advisories expand the list of blocked addresses in response to the hackers’ shifting tactics.