The hackers behind Binances $6.3 billion theft have begun converting stolen Solana tokens into Bitcoin after largely emptying the wallets used to launder funds on Tron, according to blockchain investigators.
Lookonchain reported Sunday that the hackers had moved 486,970 Solana (SOL) tokens, worth about $46.4 million, and were swapping them for Bitcoin (BTC) through Relay.
The activity involves funds that escaped the freezes imposed after Thursdays theft, the largest in cryptocurrency history. Industry partners, including Tether and Circle, froze about $3 billion in stolen assets, while investigator SomaXBT estimated the attackers still controlled about $3.5 billion.
Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop before investigators identified additional breach points. The exchange began restoring withdrawals Sunday, pledged to cover the losses and has been working with US authorities to trace and recover the stolen assets.
Related: OKX draws $445M in net inflows as Binance outflows exceed $7B
Chainalysis said Sunday that most of the hackers temporary holding wallets on Tron had been emptied as laundering activity expanded to Solana. It put the value of the Tron transfers at about $500 million.
The $500 million figure counted transfers during laundering, including repeated movements between wallets, SomaXBT said in response. About $242 million actually left the Tron holding wallets, he said.
Chainalysis said Friday that hackers may be using automation to obscure the trail, citing thousands of transactions in a short period. The firm observed funds circulating repeatedly between wallets, sometimes returning to addresses used earlier in the sequence.
Source: Chainalysis
FBI asks crypto services to block hackers transactions
Some stolen funds also reached centralized exchange Gate. Lookonchain reported Monday that the hackers had deposited about $250,000 there over the preceding 12 hours.
Gate subsequently said it had frozen two linked accounts and would cooperate with law enforcement. Its statement did not specify how much money was frozen.
The FBI on Saturday attributed Thursday‘s theft to North Korea’s TraderTraitor hackers and published wallet addresses linked to the stolen assets.
The agency, US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and decentralized finance (DeFi) services to block transactions involving those addresses or funds traced back to them.
Investigators had observed the hackers converting stolen assets primarily into Ether (ETH) and expected further laundering through DeFi and instant swap services, the FBI said.
Magazine: THORChain founder rejects freeze request, CZ thanks Secret Service: Hodlers Digest