Hackers convert stolen Solana into Bitcoin amid ongoing investigation into $6.3 billion breach
Following the massive $6.3 billion Binance hack, attackers moved $46.4 million in Solana tokens to exchange for Bitcoin via Relay. The transactions occurred after funds were transferred from frozen Tron wallets and are part of a broader laundering effort. U.S. authorities have linked the attack to North Korean hackers and are urging exchanges to block related addresses.
In November 2026, hackers linked to the $6.3 billion Binance breach initiated a new phase of fund movement by transferring 486,970 Solana (SOL) tokens—valued at approximately $46.4 million—into Bitcoin via the Relay platform. This activity followed the near-total withdrawal of funds from temporary Tron wallets, which had been used to stage initial transfers after the attack. Despite efforts by Tether and Circle to freeze about $3 billion in stolen assets, investigators estimate that roughly $3.5 billion remains unaccounted for, with Chainalysis identifying around $500 million in Tron-related transactions, of which approximately $242 million had actually exited holding wallets. The attackers employed complex laundering tactics, including rapid, repeated transfers across multiple addresses and automated systems to obscure the trail. Some stolen funds reached Gate, a centralized exchange, where deposits totaling $250,000 were recorded in the 12 hours before Monday; Gate subsequently froze two related accounts and pledged cooperation with authorities. The FBI, along with the U.S. Secret Service and IRS Criminal Investigation, attributed the attack to North Korea’s TraderTraitor group and issued public warnings urging exchanges, THORChain node operators, and DeFi platforms to block transactions tied to identified wallet addresses. Binance confirmed that its hot wallets were compromised, initially pointing to a hacked employee laptop but later identifying additional vulnerabilities
The laundering of stolen cryptocurrency through multiple blockchains—especially from Solana to Bitcoin via Relay—highlights the evolving sophistication of cybercriminals in the crypto space. This case could signal a broader trend where attackers exploit decentralized infrastructure to evade detection, challenging regulatory and enforcement capabilities across jurisdictions. The involvement of North Korean hackers underscores how state-sponsored groups are increasingly targeting financial systems for profit, raising concerns about national security implications and the role of digital assets in illicit finance. Similar to the 2016 Bitfinex hack or the 2022 Ronin Bridge breach, this incident may prompt exchanges and regulators to strengthen real-time monitoring and address-sharing protocols. However, the decentralized nature of platforms like Relay and THORChain complicates enforcement, especially when transactions are routed through privacy-enhancing tools. The outcome may depend on whe