The perpetrators of the $6.3 billion Binance theft have started swapping stolen Solana (SOL) for Bitcoin (BTC), blockchain investigators said, after draining most of the Tron-based wallets they had been using to move the funds.

Lookonchain reported Sunday that the hackers had moved 486,970 SOL, worth about $46.4 million, and were swapping the tokens for Bitcoin through Relay, a cross-chain protocol for moving tokens between blockchains.

The laundering involves assets that slipped past the freezes imposed after Thursday's theft, the largest in cryptocurrency history, more than four times the previous record of roughly $1.5 billion stolen from exchange Bybit in February 2025. Industry partners such as Tether and Circle froze roughly $3 billion of the stolen funds — freezes that are possible because stablecoins are centrally issued and their issuers can blacklist addresses, a lever that does not exist for native assets such as Bitcoin, Ether, or Solana — while investigator SomaXBT estimated the attackers still held about $3.5 billion.

Binance said the breach compromised its hot wallets — the internet-connected wallets exchanges use for customer withdrawals — and early findings pointed to a hacked employee laptop before investigators uncovered additional entry points. The exchange began restoring withdrawals on Sunday, pledged to cover the losses, and has been working with US authorities to trace and recover the stolen assets.

Related: OKX draws $445 million in net inflows as Binance outflows exceed $7 billion.

In a Sunday update, Chainalysis said most of the hackers' temporary holding wallets on Tron had been emptied as the laundering operation expanded to Solana. The analytics firm valued the Tron transfers at roughly $500 million.

SomaXBT noted in response that the $500 million figure reflected all transfers during the laundering process, including repeated movements between wallets, while only about $242 million actually left the Tron holding wallets.

On Friday, Chainalysis reported that the hackers appear to be using automation to obscure their trail, pointing to thousands of transactions executed in a short window. The firm observed funds cycling repeatedly between addresses, at times returning to wallets used earlier in the sequence.

FBI asks crypto services to block hackers' transactions

Some of the stolen funds also reached centralized exchange Gate. Lookonchain reported Monday that the hackers deposited roughly $250,000 to the platform over the previous 12 hours. Gate said it has since frozen two linked accounts and will cooperate with law enforcement, though its statement did not specify the amount frozen.

The FBI on Saturday attributed the theft to TraderTraitor, a North Korean hacking group that US agencies have previously tied to other major crypto thefts, including the roughly $620 million Ronin Network bridge hack of 2022, and published the wallet addresses linked to the stolen assets.

Alongside the US Secret Service and IRS Criminal Investigation, the agency urged THORChain node operators, exchanges and decentralized finance (DeFi) services to block transactions involving those addresses or funds traced to them. THORChain is a decentralized cross-chain swap protocol that runs on independent node operators rather than a central company.

Investigators had observed the hackers converting the stolen assets primarily into Ether (ETH) before the moves into Solana and Bitcoin, and expected further laundering through DeFi protocols and instant swap services, according to the FBI.