Stolen Solana tokens from Binance breach now being converted to Bitcoin, Chainalysis reports
Following U.S. investigator warnings to block transactions connected to the massive $6.3 billion heist, cryptocurrency exchange Gate announced it has frozen two associated accounts.
Blockchain investigators report that the perpetrators of the $6.3 billion Binance heist have started converting their stolen Solana tokens to Bitcoin following the near-complete depletion of the wallets they used for laundering operations on the Tron network.
On Sunday, Lookonchain documented that the cybercriminals had transferred 486,970 Solana (SOL) tokens, valued at approximately $46.4 million, and were in the process of exchanging them for Bitcoin (BTC) via Relay.
These transactions involve assets that managed to evade the freezing measures implemented in the wake of Thursday's unprecedented cryptocurrency theft. Following the breach, industry collaborators including Tether and Circle successfully froze roughly $3 billion worth of the stolen digital assets, though investigator SomaXBT calculated that the perpetrators maintained control over approximately $3.5 billion.
The cryptocurrency exchange Binance revealed that the security breach affected its hot wallets, with preliminary analysis suggesting a compromised employee laptop as the initial entry point before further investigation uncovered additional vulnerability exploitations. On Sunday, the platform commenced the restoration of withdrawal services, committed to reimbursing all losses, and confirmed its ongoing collaboration with United States authorities in efforts to track down and retrieve the stolen cryptocurrency holdings.
In a Sunday update, Chainalysis indicated that the majority of the attackers' interim storage wallets on the Tron blockchain had been drained as their money laundering operations spread to the Solana network. The blockchain analytics company valued the Tron-based transfers at approximately $500 million.
However, SomaXBT clarified in response that the $500 million calculation accounted for transfers occurring during the laundering process, which included multiple movements between various wallets. The actual amount that exited the Tron holding wallets totaled around $242 million, according to his assessment.
In a Friday analysis, Chainalysis suggested the hackers might be employing automated systems to complicate tracking efforts, pointing to the execution of thousands of transactions within condensed timeframes. The analytics firm documented funds cycling repeatedly among different wallets, with some transactions sending assets back to addresses that had been utilized previously in the laundering chain.
FBI asks crypto services to block hackers' transactions
A portion of the stolen cryptocurrency also made its way to centralized platform Gate. On Monday, Lookonchain disclosed that the hackers had deposited roughly $250,000 to that exchange during the previous 12-hour period.
In response, Gate announced it had frozen two connected accounts and pledged full cooperation with law enforcement agencies. The exchange's official statement did not disclose the exact amount of funds that had been frozen.
On Saturday, the FBI publicly attributed Thursday's major theft to the TraderTraitor hacking group operating out of North Korea and released a list of wallet addresses connected to the stolen cryptocurrency.
The federal agency, working alongside the US Secret Service and IRS Criminal Investigation, issued an appeal to THORChain node operators, cryptocurrency exchanges, and decentralized finance (DeFi) platforms to prevent transactions associated with those specific addresses or any funds that can be traced to them.
According to the FBI, investigators had documented the hackers primarily converting their stolen digital assets into Ether (ETH) and anticipated continued laundering activities through DeFi protocols and instant cryptocurrency exchange services.