North Korea-linked hackers move stolen Binance funds to Solana
Chainalysis reported that attackers behind the $6.3bn Binance breach transferred funds after draining $500m from Tron wallets.
Key takeaways
- 1Chainalysis traced North Korea-linked hackers moving stolen Binance funds onto Solana after taking $500m from Tron wallets.
- 2The movement follows a $6.3bn security breach at Binance, the largest heist in crypto history.
- 3Tether previously froze $971m in USDT linked to the incident, while Thorchain paused bridges handling $2.5bn.
North Korea-linked hackers began transferring stolen Binance funds onto the Solana network after draining $500m from Tron wallets on 1 November 2026, according to blockchain analytics firm Chainalysis. The capital movement follows ongoing attempts by the perpetrators to launder proceeds from a major security breach.
Degen News reported that Chainalysis identified the shift to Solana as the attackers moved funds away from Tron addresses. The hackers previously routed assets through Tron after stablecoin issuer Tether froze $971m in USDT linked to suspicious transfers on 29 October 2026.
The transfers form part of the laundering process following a $6.3bn exploit at crypto exchange Binance in late October, which authorities attributed to North Korea. On 31 October 2026, cross-chain protocol Thorchain paused its bridges after an Ethereum reorganisation, delaying the laundering of $2.5bn in stolen funds. Solana traded at $94.62 with a market capitalisation of $55.8bn, while Tron stood at $0.313.
The rapid relocation of funds across multiple blockchains shows how exploiters switch networks when encountering asset freezes or protocol downtime. Security teams and exchange compliance desks will watch whether validator operators or decentralized protocols on Solana take steps to trace or flag the addresses.
Also reported by
- Lookonchain
- The Block
- CoinGape
- Tree News
- Watcher Guru
- CoinDesk
- Wu Blockchain
- Cointelegraph
- Decrypt
- The Defiant
- Degen News
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.