Binance Hackers Swap $46M in Stolen Solana for Bitcoin as Gate Freezes Linked Accounts

Wallets linked to the $6.3 billion Binance hack have begun converting stolen Solana (SOL) into Bitcoin (BTC), adding another stage to the laundering operation. The activity comes as crypto exchange Gate freezes two accounts associated with the stolen funds following requests from US investigators.

Blockchain tracker Lookonchain reported that the attackers controlled approximately 970,522 SOL, worth around $95.9 million. Within one hour, they moved 486,970 SOL, valued at approximately $46.4 million, toward Bitcoin swaps through Relay Protocol. The transactions represent a significant shift in how the attackers are moving assets following the October 29 breach.

Hackers move stolen Solana through Relay

The latest activity involves funds that remained outside the freezes imposed after the Binance incident. Lookonchain identified Relay as the route used to exchange the SOL for Bitcoin.

However, the reported movement does not establish that the entire $46.4 million has already reached final Bitcoin wallets. Cross-chain swaps can involve several transactions, and investigators are continuing to follow the funds.

The shift also follows an earlier laundering phase involving Tron. Blockchain analytics firm Chainalysis said the attackers had largely emptied temporary holding wallets on Tron, where funds were distributed across thousands of addresses.

Elliptic's November 2 investigation provides further context. It identified activity across approximately 12,000 wallets on 11 blockchains, involving more than 40,000 transactions in less than four days. The firm also reported that stolen assets on Solana, Ethereum, NEAR, and XRP had started moving as the Tron activity slowed.

Gate freezes two accounts linked to stolen funds

The stolen assets have also reached centralized exchanges. Lookonchain reported that approximately $250,000 in funds linked to the attackers had been deposited into Gate over a 12-hour period.

Gate subsequently confirmed that it had frozen two associated accounts and would cooperate with law enforcement. The exchange did not disclose the amount frozen or confirm whether the accounts contained the full reported deposit.

The action follows a request from US investigators to crypto platforms and infrastructure providers to block transactions connected to the stolen assets.

On October 31, the FBI attributed the Binance theft to North Korea's TraderTraitor hacking group. The FBI, US Secret Service, and IRS Criminal Investigation also urged exchanges, DeFi services, THORChain node operators, and other virtual asset providers to block transactions involving the identified wallet addresses or funds derived from them.

The FBI published a list of addresses connected to the operation as part of its effort to limit further movement of the stolen cryptocurrency.

Why converting SOL into Bitcoin matters

The conversion from Solana to Bitcoin highlights a challenge for investigators tracking stolen digital assets. Some centralized stablecoin issuers can freeze tokens associated with suspicious transactions. However, native Bitcoin and Solana assets do not have a central issuer that can directly blacklist individual balances.

Moving funds through cross-chain services adds another layer to the investigation. Each swap creates additional transaction records, but it can also move assets into networks and wallets where intervention is more difficult.

A similar issue emerged during the September Bitget hack. Attackers moved stolen assets toward Bitcoin through THORChain, prompting debate over whether decentralized cross-chain services should block wallets associated with thefts. Altcoin Buzz previously examined that dispute and THORChain's refusal to block the Bitget-linked wallets.

The Binance incident has also shown how quickly stolen assets can move between protocols. In an earlier report, Altcoin Buzz detailed how the attackers used Aave to borrow ETH against stolen USDT, moving value into an asset that stablecoin issuers cannot freeze in the same way.

Binance hack investigation remains ongoing

The October 29 attack affected approximately $6.3 billion in crypto assets, according to Binance. Blockchain analytics firms have linked the incident to North Korea's TraderTraitor group, while the FBI has publicly attributed the theft to the same group.

Related: North Korea Stole $6.36B From Binance; About $2.7B Is Frozen

Binance has said it will cover the financial impact of the incident and has worked with industry partners to freeze affected assets. The exchange has also begun restoring services and replenishing the affected token balances.

But the movement of stolen SOL toward Bitcoin shows that the recovery effort is not over. Investigators and exchanges must continue tracking funds as attackers move them across networks, swap services, and accounts.