In this article5 sections
The hackers behind the $6.3 billion Binance theft have started converting stolen Solana into Bitcoin after largely emptying the wallets they used to move funds on Tron, Cointelegraph reported, citing blockchain investigators. Lookonchain said Sunday that 486,970 Solana (SOL) tokens, worth about $46.4 million, had been moved and were being swapped for Bitcoin (BTC) through Relay.
The tokens came from funds that escaped the freezes imposed after Thursday’s breach, which Cointelegraph described as the largest in cryptocurrency history. Industry partners including Tether and Circle froze roughly $3 billion in stolen assets, while investigator SomaXBT estimated the attackers still held about $3.5 billion.
Also read: Binance's $6.3B hack linked to North Korea's TraderTraitor
Key facts
- Lookonchain reported the movement of 486,970 SOL, valued at about $46.4 million, being converted to Bitcoin via Relay.
- Chainalysis said most of the hackers’ temporary holding wallets on Tron had been emptied, with transfers there valued at about $500 million.
- The FBI on Saturday attributed the theft to North Korea’s TraderTraitor group and published wallet addresses tied to the stolen assets.
- Binance said the attack compromised its hot wallets, with early findings pointing to a hacked employee laptop.
- According to Crypto Briefing, Binance had replenished roughly 95% of stolen assets, about $6 billion, by November 1.
Two counts of the Tron transfers
The two outlets do not agree on how much actually left the Tron wallets. Cointelegraph’s report of about $500 million covers transfers during laundering, including repeated movements between wallets, SomaXBT said, and the investigator put the amount that genuinely departed those wallets at about $242 million.
Chainalysis said Friday that automation may be helping the hackers obscure the trail, pointing to thousands of transactions in a short window and funds cycling back to addresses used earlier in the sequence. Some stolen funds also reached the centralized exchange Gate; Lookonchain reported a deposit of about $250,000 there over the preceding 12 hours. Gate said it froze two linked accounts and would work with law enforcement, without saying how much was held.
The FBI, the US Secret Service and IRS Criminal Investigation urged THORChain node operators, exchanges and decentralized finance services to block transactions linked to the published addresses or to funds traced from them. Investigators had seen the hackers convert stolen assets mainly into Ether and expected further laundering through DeFi and instant swap tools, the FBI said.
Binance restores balances and reopens withdrawals
Binance began restoring withdrawals on Sunday, pledged to cover the losses and has been working with US authorities on tracing and recovery. Crypto Briefing reported that withdrawals restarted in phases on November 1 and that the exchange set aside more than $6.34 billion of its own money, drawn from its Secure Asset Fund for Users and Futures Insurance Fund, to make customers whole. Bitcoin, Ether, Tether, BNB and Zcash were each restored to 100% backing, and Binance published a Proof of Reserves snapshot.
Crypto Briefing also reported, citing Reuters, that deposit volumes stayed substantial and that outflows spiked before levelling off, and that Bitcoin traded above $78,000 on Monday after sliding to a six-week low on Friday.
Why it matters
For customers, the replenishment figure is the one that counts: holders of the five fully backed tokens no longer have an immediate reason to pull funds, which is why the withdrawal queue began to settle. The case also puts pressure on exchanges and cross-chain infrastructure to police flagged addresses, since funds that slip past freezes can still be swapped into less traceable assets. The scale dwarfs earlier exchange failures, and the attribution to a state-linked group makes recovery a law-enforcement question as much as a technical one.
What to watch
Whether outflows keep easing as withdrawals fully reopen, how much of the frozen $3 billion is eventually recovered, and whether the hackers manage to move further funds through DeFi or swap services before node operators and exchanges act on the FBI’s addresses.
This article covers reported on-chain activity and does not constitute financial advice. Cryptocurrency markets are volatile and uncertain.
Reported by Cointelegraph.
Sources: Cointelegraph, Crypto Briefing