The perpetrators behind the $6.3 billion Binance breach have initiated the conversion of looted Solana assets into Bitcoin, having largely depleted the addresses utilized to launder capital across the Tron network, according to blockchain analytics experts.
On Sunday, Lookonchain reported that the threat actors had transferred 486,970 Solana (SOL) coins, valued at approximately $46.4 million, and were exchanging them for Bitcoin (BTC) via Relay.
This activity involves funds that bypassed the freezes enacted following Thursday’s incident, which stands as the largest breach in digital asset history. Industry participants, such as Tether and Circle, locked roughly $3 billion worth of compromised tokens, whereas investigator SomaXBT estimated that the criminals still maintained control over about $3.5 billion.
Binance stated that the security breach affected its hot wallets, with preliminary findings pointing toward a compromised staff laptop prior to the discovery of additional vulnerability points. The trading platform reopened withdrawal capabilities on Sunday, committed to covering the deficit, and continues to collaborate with American law enforcement to track and retrieve the taken funds.
Related: OKX draws $445M in net inflows as Binance outflows exceed $7B
Chainalysis announced Sunday that the majority of the hackers’ temporary storage addresses on Tron had been drained as the money-laundering operations shifted toward Solana. The firm valued the Tron transactions at roughly $500 million.
The $500 million metric accounted for transfers throughout the laundering process, including circular movements between addresses, noted SomaXBT in a reply. He specified that approximately $242 million physically departed the Tron holding wallets.
On Friday, Chainalysis indicated that the culprits might be employing automated scripts to obscure the transaction trail, pointing to thousands of transfers executed within a brief timeframe. The organization noticed assets circulating repeatedly among accounts, occasionally routing back to destinations utilized earlier in the sequence.
Source: Chainalysis
FBI asks crypto services to block hackers’ transactions
A portion of the illicit capital also arrived at the centralized trading venue Gate. Lookonchain reported Monday that the threat actors had deposited roughly $250,000 there over the preceding half-day period.
Gate subsequently stated that it had locked two connected profiles and would work alongside legal authorities. The announcement omitted the precise monetary figure that was frozen.
On Saturday, the FBI attributed Thursday’s intrusion to North Korean operatives known as TraderTraitor, publishing specific wallet designations associated with the stolen tokens.
The bureau, along with the US Secret Service and IRS Criminal Investigation, called upon THORChain node operators, digital asset exchanges, and decentralized finance protocols to restrict any transfers linked to those addresses or originating from them.
Investigators observed the perpetrators converting the compromised reserves primarily into Ether (ETH) and anticipated additional laundering efforts via decentralized finance and instantaneous exchange tools, according to the FBI.
Magazine: THORChain founder rejects freeze request, CZ thanks Secret Service: Hodler’s Digest
Originally published at https://cointelegraph.com/news/binance-hackers-solana-new-phase-laundering-chainalysis?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound.
