Binance hackers swap stolen Solana for Bitcoin as Gate freezes two linked accounts
In brief
- Lookonchain said hackers moved 486,970 SOL, worth about $46.4 million, and swapped it for BTC via Relay.
- Chainalysis said most Tron holding wallets were emptied; SomaXBT disputes its $500 million transfer figure.
- Gate froze two linked accounts after about $250,000 in deposits but didn't disclose the frozen amount.
- FBI attributed the theft to North Korea's TraderTraitor and published linked wallet addresses.
From Tron to Solana to Bitcoin
Lookonchain reported on Sunday that the hackers had moved 486,970 SOL, worth about $46.4 million, and were swapping it for BTC through Relay. That's money that slipped past the freezes imposed after Thursday's theft (which Cointelegraph described as the largest in crypto history).
Chainalysis said on Sunday that most of the hackers' temporary holding wallets on Tron had been emptied as laundering expanded to Solana. The firm put the value of the Tron transfers at about $500 million.
That figure is disputed.
Investigator SomaXBT said the $500 million count included repeated movements between wallets during laundering, and that only about $242 million actually left the Tron holding wallets. The trail isn't easy to follow either way. Chainalysis said on Friday the hackers may have been using automation to obscure it, pointing to thousands of transactions in a short period, with funds circulating repeatedly between wallets and sometimes returning to addresses used earlier in the sequence.
How much is still out there?
Industry partners, including Tether and Circle, froze about $3 billion in stolen assets. SomaXBT estimated the attackers still controlled about $3.5 billion.
Binance said the attack compromised its hot wallets. Initial findings pointed to a hacked employee laptop, though investigators later identified additional breach points. The exchange began restoring withdrawals on Sunday, pledged to cover the losses and has worked with US authorities to trace and recover the assets.
Gate freezes accounts as FBI names North Korea
Lookonchain reported on Monday that the hackers had deposited about $250,000 to Gate over the preceding 12 hours. Gate then said it had frozen two linked accounts and would cooperate with law enforcement. It didn't say how much was frozen.
The FBI on Saturday attributed the theft to North Korea's TraderTraitor hackers and published wallet addresses linked to the stolen assets. The FBI, the US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and DeFi services to block transactions involving those addresses (or funds traced back to them).
The FBI said investigators had seen the hackers converting stolen assets mainly into Ether, and it expects further laundering through DeFi and instant swap services.
Frequently asked questions
Who did the FBI say is behind the Binance hack?
The FBI on Saturday attributed the theft to North Korea's TraderTraitor hackers and published wallet addresses linked to the stolen assets. It said investigators had seen the hackers converting stolen assets mainly into Ether.
How much of the stolen Binance funds has been frozen?
Industry partners, including Tether and Circle, froze about $3 billion in stolen assets, according to Cointelegraph. Investigator SomaXBT estimated the attackers still controlled about $3.5 billion. Gate froze two linked accounts but didn't say how much was in them.
Why do Chainalysis and SomaXBT disagree on the Tron figure?
Chainalysis put the value of the hackers' Tron transfers at about $500 million. SomaXBT said that figure counted repeated movements between wallets during laundering, and that only about $242 million actually left the Tron holding wallets.
