Actors linked to North Korea who are laundering funds stolen from Binance have started moving money onto Solana, according to Chainalysis. The firm says the attackers first drained about $500 million from Tron staging wallets. It gave no Solana-specific total.
North Korean-linked actors laundering Binance-hack funds have begun moving onto Solana after draining about $500 million from Tron staging wallets, blockchain analytics firm Chainalysis said on Nov. 1. The firm did not give a Solana-specific total or asset breakdown in its written update.
Tron funds spread across more than 1,000 addresses
Chainalysis said the attackers moved more than $500 million on Tron after the Oct. 29 exploit, using more than 1,000 addresses, over 3,000 deposits and multiple DeFi protocols. According to Chainalysis: "Most TRON staging addresses are now drained," it wrote.
The firm named Chainflip, Relay, THORChain and NEAR among the routes taking funds out of Tron to dozens of fresh wallets on Ethereum, Bitcoin and other chains. Individual transfers ranged from less than $5,000 to more than $100,000, it said.
A wallet swaps SOL for bitcoin
Separately, onchain investigator Lookonchain reported on Nov. 1 that a Binance-hack wallet had moved 486,970 SOL, valued by the firm at $46.4 million, in the preceding hour. The wallet was swapping SOL for bitcoin through Relay. That report describes a SOL-to-bitcoin exit, not a quantified inflow from Tron.
The earlier Tron route already crossed chains. As The Defiant reported on Oct. 31, Chainalysis described attackers depositing stablecoins in lending protocols, transferring deposit receipts to fresh wallets, then redeeming them and bridging into ETH.
Freeze controls depend on the asset
For freeze efforts, the asset received matters, not just the destination blockchain. Circle's access-denial policy says it can block stablecoin transfers on every chain where it issues them, and Solana is one of its USDC networks. By contrast, Chainalysis describes bitcoin and ETH as assets beyond stablecoin issuers' freeze controls.
Chainalysis said it had attributed downstream addresses and was continuing to trace funds across chains, including Solana. The FBI's Oct. 31 alert, which attributes the theft of more than $6 billion to North Korea's TraderTraitor activity, urged exchanges, DeFi services and infrastructure operators to block transactions involving the listed addresses.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
