Binance hackers convert stolen Solana tokens to Bitcoin after $6.3 billion theft

Following an October 29, 2026 cyberattack on Binance that resulted in the theft of $6.3 billion in virtual assets, attackers began converting 970,522 stolen Solana tokens worth $96 million into Bitcoin via Relay Protocol. U.S. authorities attributed the heist to North Korea’s TraderTraitor group, leading issuers like Tether and Circle to freeze $3 billion. North Korea denied involvement, while Binance reopened withdrawals and moved to cover customer losses.

Binance hack stolen asset laundering

• ▪The Binance attackers converted over 130 stolen altcoins across Ethereum-compatible networks into approximately 123,400 Ether worth $277.26 million and 1.69 million USDC.
• ▪Binance pledged to cover customer losses using company resources and emergency reserves, having replenished about 95% of affected assets as of November 3, 2026.
• ▪A cyberattack on cryptocurrency exchange Binance compromised hot wallets and resulted in the theft of an estimated $6.3 billion in virtual assets
• ▪Binance began progressively reopening customer withdrawals
• ▪The Binance attackers swapped 908,793 stolen PROM tokens valued near $5 million through a Uniswap V2 liquidity pool, receiving only 0.0316 Ether worth $71 due to low liquidity.

Solana to Bitcoin conversion operations

• ▪The Binance attackers moved 486,970 Solana tokens worth roughly $46.4 million within one hour using Relay Protocol to execute cross-chain swaps into Bitcoin.
• ▪The Binance attackers began moving 970,522 stolen Solana tokens, valued at approximately $96 million, toward Bitcoin conversions
• ▪The conversion of stolen Solana tokens into Bitcoin marked an expansion of laundering routes after temporary holding wallets on the Tron network were largely emptied.

North Korea TraderTraitor attribution

• ▪The FBI attributed the $6.3 billion Binance cyberattack to North Korea's state-backed hacking group known as TraderTraitor
• ▪The Federal Bureau of Investigation, Secret Service, and IRS Criminal Investigation requested cryptocurrency services and operators to block transactions linked to identified Binance attacker wallet addresses.
• ▪Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected U.S. allegations linking Pyongyang to the Binance hack, calling the FBI attribution a political provocation.

Blockchain tracking of stolen funds

• ▪In the first four days following the Binance hack, attackers utilized roughly 12,000 temporary wallets across 11 blockchains and conducted over 40,000 transactions to obscure funds.
• ▪Blockchain analytics firm Elliptic identified early signs of bitcoin mixing by the Binance attackers, with approximately 28 bitcoin worth $2.2 million passing through 18 mixing transactions by November 2, 2026.
• ▪Blockchain network THORChain halted trading on 10 of its 13 chains over the weekend of October 31 to November 1, 2026, after being used by the Binance attacker to route funds.

Asset freezing by crypto services

• ▪Asset issuers including Tether and Circle froze approximately $3 billion in stolen cryptocurrency assets shortly after the October 29, 2026 Binance breach.
• ▪Centralized cryptocurrency exchange Gate froze two accounts and cooperated with law enforcement after the Binance attackers deposited approximately $250,000 in stolen funds onto the platform.
• ▪On-chain analysts estimated that despite issuer freezes, the Binance attackers retained control of roughly $3.24 billion to $3.5 billion in stolen cryptocurrency.

Public messages to hacker wallets

• ▪One sender spent about $46 in bitcoin plus fees sending the message 'Help me bro' three times to each of the 19 Binance attacker wallet addresses.
• ▪Strangers sent tiny bitcoin payments containing embedded notes via the OP_RETURN field to 19 wallets holding 18,270 bitcoin stolen in the Binance breach.
• ▪Embedded messages attached to transactions sent to the Binance attacker wallets included phishing links mimicking THORChain swap sites, promotions for the $NST token, and requests for treats.