Three days after the October 29 Binance exploit, the laundering trail has shifted chains. North Korea-linked actors have drained most of their Tron staging wallets and started moving money onto Solana, with no Solana-specific total disclosed yet.

More than $500M passed through Tron, spread across 1,000+ addresses, 3,000+ deposits and multiple DeFi protocols.

Funds left Tron via Chainflip, Relay, THORChain and NEAR into dozens of fresh wallets on Ethereum, Bitcoin and other chains, in transfers ranging from under $5,000 to over $100,000. Separately, a hack wallet swapped 486,970 SOL ($46.4M) for bitcoin through Relay in a single hour.

The FBI attributes the theft of more than $6B to North Korea's TraderTraitor group and has urged exchanges and DeFi services to block the listed addresses. Funds that end up in BTC or ETH sit beyond the reach of stablecoin issuers' freeze controls.