Blockchain investigators have identified a new phase in the laundering of assets stolen in the Binance hack that resulted in a $6.3 billion loss. The attackers have transferred 486,970 Solana (SOL) tokens, worth roughly $46.4 million, and are swapping them for Bitcoin (BTC) through the Relay service.
The move follows the near‑complete depletion of temporary holding wallets on the Tron network, which had been used earlier in the laundering chain. Chainalysis estimated the value of Tron transfers at about $500 million, though only $242 million actually left those wallets.
Industry partners, including Tether and Circle, previously froze approximately $3 billion of the stolen assets. Analyst SomaXBT estimates that the hackers still control around $3.5 billion. Binance confirmed that the breach involved its hot wallets, initially traced to a compromised employee laptop, and said it is working with U.S. authorities to trace and recover the funds while restoring withdrawals.
Additional activity was observed on the centralized exchange Gate, where about $250,000 was deposited by the hackers over a 12‑hour period. Gate froze two linked accounts and pledged cooperation with law enforcement.
The FBI, Secret Service and IRS Criminal Investigation have linked the theft to the North Korean “TraderTraitor” group and have urged exchanges, DeFi services, and THORChain node operators to block transactions involving the identified addresses. The agencies noted that the hackers have previously converted stolen assets primarily into Ether (ETH) and may continue to use DeFi platforms and instant swap services for further laundering.
