Three days after the October 29 Binance exploit, the laundering trail has shifted chains. North Korea-linked actors have drained most of their Tron staging wallets and started moving money onto Solana, with no Solana-specific total disclosed yet.

More than $500M passed through Tron, spread across 1,000+ addresses, 3,000+ deposits and multiple DeFi protocols.

Funds left Tron via Chainflip, Relay, THORChain and NEAR into dozens of fresh wallets on Ethereum, Bitcoin and other chains, in transfers ranging from under $5,000 to over $100,000. Separately, a hack wallet swapped 486,970 SOL ($46.4M) for bitcoin through Relay in a single hour.

The FBI attributes the theft of more than $6B to North Korea's TraderTraitor group and has urged exchanges and DeFi services to block the listed addresses. Funds that end up in BTC or ETH sit beyond the reach of stablecoin issuers' freeze controls.

The wallet behind the October 29 Binance exploit has started converting its Solana haul into bitcoin. The address holds 970,522 SOL taken in the attack, worth about $95.9M.

In the past hour alone, the hacker moved 486,970 SOL ($46.4M) and is routing it into BTC through the cross-chain bridge Relay Protocol.

Solana was a small slice of the roughly $6.3B taken from the exchange, the largest crypto heist on record, attributed to the North Korea-linked group TraderTraitor. About $3B in stablecoins has been frozen, while swaps like this one move the remaining assets into coins that are harder to seize.

Three days after the October 29 breach of Binance hot wallets, the attacker is converting stolen tokens into more liquid assets. On EVM chains alone, the hacker has dumped more than 130 different altcoins, swapping them into ETH and USDC.

The sales brought in 123,400 ETH (about $277.26M) and 1.69M USDC, roughly $279M in total.

The tally covers EVM networks only, so the full volume across all chains is likely higher. Swapping long-tail tokens into ETH and stablecoins is a typical step before funds move through bridges and mixers, and it adds selling pressure on the affected altcoins.

The FBI has reportedly attributed the $6B+ Binance hack to North Korea's TraderTraitor group.

Withdrawals on Binance have been frozen since last week's security incident, which the exchange traced to a compromised DevOps engineer's laptop. Its fourth recovery update sets phase one of the restart for November 1 between 06:00 and 09:00 UTC.

The first wave covers 15 networks, including BTC, Ethereum, BNB Chain, Tron, Solana, XRP, Arbitrum, Base and Sui, with USDT and USDC on most of them. Assets were prioritized by user demand over the past week, and more networks will be added once security checks are complete. Deposits were not affected.

Binance says it has now covered about 95% of the hacked amount with company funds, up from 90% a day earlier.

The remaining 5% are less liquid tokens outside the top ten that the exchange is still buying through market and OTC channels. Users may see delays during the rollout, and a full post-incident report is promised once the investigation ends.

Laundering of funds from the $6B+ Binance hack, which the FBI has reportedly attributed to North Korea's TraderTraitor group, has moved onto cross-chain bridges. Roughly $38M passed through Relay Protocol in about seven hours, with transfers still in progress at the time of the alert.

Relay says it runs active KYT (know-your-transaction) screening designed to stop flagged funds, yet the flows went through. The same wallets could not move funds at a comparable pace through THORChain.

$38M bridged in 7 hours, with transfers still ongoing.

Bridges and swap protocols remain the main exit route for large exploits, and the case puts pressure on Relay to block further transfers from the flagged addresses.

The October 29 theft from Binance hot wallets now has an official attribution: the FBI linked the attack to North Korea's TraderTraitor group and urged the industry to help block laundering of the stolen crypto.

Unauthorized transfers totaled about $6.4B across multiple blockchains, the largest theft in crypto history. Roughly $2.8B has been frozen so far.

The FBI blamed the same unit for the $1.5B Bybit theft in February 2025. Blockchain analytics firms TRM Labs and Chainalysis had already pointed to TraderTraitor a day after the hack, after stolen funds commingled on-chain with proceeds from last month's Bitget theft.

Binance says 90% of the stolen assets have already been replenished.

The exchange has started drawing on its emergency reserve after a breach it estimates at $6.3 billion, confirming a 7,499 BTC transfer out of its SAFU fund to help cover user losses.

Binance says it has already replenished 90% of the stolen amount and plans to rebuild SAFU to about $1 billion afterwards.

The exchange has pledged to cover all losses from SAFU and company funds, and earlier said it had reserved over $6.34 billion for that purpose. Withdrawals remain paused while the withdrawal service is rebuilt, with a restart targeted for November 1 and a full Proof of Reserves report expected by November 3.

The biggest crypto hack in history began with a rehearsal: before the October 29 breach, attackers ran two test sequences of code on Ethereum accounts they controlled while trading on Binance carried on as normal.

The rogue code then gave them access to exchange-owned blockchain accounts. As the attackers emptied those wallets, Binance's own funds kept refilling them, and the drain continued.

Most of the estimated $6.3B left Binance hot wallets on 10 blockchains in about 20 minutes.

The account shows how automated hot wallet top-ups can amplify a breach once attackers control withdrawals from exchange accounts.

Two days after setting aside more than $6.34B of company funds for the record hot wallet breach, Binance published its third recovery update: replenished assets now cover 90% of the stolen amount, up from about 80% in the previous update.

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now 100% backed. The remaining 10% consists of less liquid tokens outside that list, which Binance is still buying through market and OTC channels with industry partners.

The gap is being filled with a partial deployment of the SAFU fund, part of the Futures insurance fund and the corporate treasury. Binance says users will not bear the loss and has committed to rebuilding SAFU back to about $1B.

A new Proof of Reserves snapshot was taken at 00:00 UTC on October 31, with the full zero-knowledge proof expected by November 3. The next milestone is reopening withdrawals, which the exchange says remains on track for Sunday, November 1.

Blockchain analytics firm Chainalysis, whose tools are used by exchanges and law enforcement to trace crypto flows, disclosed a security incident in a notice to customers. An external attacker using "offensive agentic techniques" gained access to its systems and internal tools in October.

The exposed data includes user IDs, full names, email addresses and organization role labels. The company found no sign that investigation graphs, cases, notes, query results, passwords, MFA secrets or session tokens were accessed.

Chainalysis has not disclosed how many users or organizations were affected and says the incident is unrelated to the recent Binance theft.

The firm has notified all customers, brought in outside security experts and is patching the exploited vulnerabilities. Names, work emails and roles could still be used for targeted phishing against customer staff.