Binance Hackers Shift Tactics: Swapping SOL for BTC as FBI Attributes Attack to North Korean Group
nashnova research
Laundering of the $6.3 billion Binance theft has spread from Tron to Solana and Bitcoin, as the FBI formally attributes the attack to North Korea-linked group TraderTraitor and calls on the entire industry to block flagged wallets.
Why do the hackers keep hopping between blockchains?
After largely emptying their staging wallets on Tron, the hackers moved 486,970 SOL (roughly $46.4 million) and converted it to Bitcoin via cross-chain protocol Relay.
This means → every chain hop forces law enforcement and on-chain analysts to redeploy tracking tools, buying the hackers a fresh laundering window.
In plain terms = it is like a thief moving stolen cash from one bank to a second, then a third — each move resets the investigative clock.
Tron showed $500 million in transfers — how much actually left?
Chainalysis estimated total Tron transfers at roughly $500 million, but that figure counts the same funds moving through multiple wallets repeatedly.
On-chain analyst SomaXBT revised the number down: actual outflows from the Tron staging wallets were about $242 million.
This means → the two figures differ by half, and the gap is the hackers' camouflage — cycling funds between wallets so a single dollar gets counted several times, obscuring the real trail.
Where do the stolen funds sit now?
Tether, Circle, and other issuers have frozen roughly $3 billion in stolen assets since the breach. SomaXBT estimates the hackers still control about $3.5 billion.
Some funds have already entered centralized exchanges: the hackers deposited about $250,000 into Gate within 12 hours. Gate froze two linked accounts.
In plain terms = frozen and unfrozen are split nearly fifty-fifty — the recovery race is far from over.
What is the FBI asking the industry to do?
The FBI, together with the U.S. Secret Service and IRS Criminal Investigation, formally attributed the attack to TraderTraitor, a North Korea-linked hacking group, and published associated wallet addresses.
The agencies urged THORChain node operators, exchanges, and DeFi — decentralized finance, financial services that run directly on-chain without intermediaries — providers to block transactions involving those addresses.
This means → this is no longer a "voluntary cooperation" phase; it is a joint directive from three U.S. law-enforcement agencies, and platforms that do not comply will face mounting regulatory pressure.
How is Binance itself responding?
Binance reopened withdrawals on Sunday and pledged that the company, not its users, will absorb the losses.
The exchange says it continues to work with U.S. authorities to trace the assets.
This reflects a "stabilize user confidence first, then assist recovery" playbook — but as the laundering trail stretches from Tron to Solana to Bitcoin, tracking difficulty is rising with every hop.
市场有风险，内容仅供研究参考，不构成投资建议。