Binance Hackers Begin Swapping 970,522 SOL Worth $95.9 Million for Bitcoin
Key Facts
Binance hackers began swapping 970,522 Solana tokens, worth about $95.9 million, for Bitcoin via a relay on Sunday, November 1, according to The Block. In a separate move, a Solana wallet linked to the hack transferred 486,970 units, worth $46.4 million, during the hour before a Lookonchain post at 5:35 a.m. U.S. Eastern time. This means the 486,970 units were moved from the wallet, while the reported swap involved a larger amount; the report did not say that the entire amount transferred was converted into Bitcoin. The report said this Solana address is the only address on that network in the FBI's list of addresses linked to the attack. The asset movements put the tracing of funds among efforts to investigate the platform hack, after authorities identified addresses on several networks.
The FBI attributed the attack to the TraderTraitor group and urged Thorchain operators and other service providers to block transactions linked to the theft, according to The Block. The bureau published a list of 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, with no Tron addresses included. In a separate estimate of fund flows through Tron, a transaction-tracking analyst said the attackers laundered about $242 million over two days through November 1. About $194 million of that amount left Tron through bridges and swap services, the analyst added. These figures show the volume of transfers analysts are tracking, while the Solana-to-Bitcoin swap remains a separate route documented in the report.
In its update published on October 30, Binance said the incident's estimated impact was about $6.3 billion and that its partners had helped freeze affected assets worth about $3 billion on-chain. The company said its initial investigation indicated that an engineer's laptop on the DevOps team may have been compromised. According to its account, this gave the attacker access to a service container and enabled the submission of unauthorized withdrawal transactions. It added that it had found no evidence of a wallet private key leak. In its first update, it said it would cover the losses from the SAFU fund and company funds, and publish an updated proof of reserves after remediation was complete.
In an update on November 1, Binance said it had covered about 95% of the affected amount, up from 90% in its previous update, and that the remaining 5% involved tokens outside the list of the 10 largest assets it had cited. The company said those tokens were less liquid in the market, making it take longer to source them in the required volume. It announced that the first phase of withdrawal resumption would begin on November 1 between 06:00 and 09:00 UTC. The phase included networks and assets such as Bitcoin and Solana, while the company said deposits remained open and were unaffected by the incident. In an update on November 2, it said the next phase would cover additional networks and assets, was scheduled for the following day and would be carried out gradually.
In an update on November 2, Binance said its cryptographic proof of reserves was complete and verifiable by users. It added that balances in 10 assets, including Solana and Bitcoin, were fully backed at a ratio of at least 1:1, and that it planned to take an additional snapshot covering other tokens on November 4. It also pledged to publish an incident report after the investigation was complete, and said it continued to work with law enforcement and industry partners to trace and recover additional funds. In the broader market, The Associated Press reported on October 30 that Bitcoin had fallen below $77,000 after topping $86,000 earlier in the month. The agency said Coinbase Global shares fell 10.6% and Strategy shares 7.8% that day, without attributing those moves to the Solana transfers.