Binance hackers have moved to a new phase in their money laundering scheme, beginning to swap stolen Solana tokens for Bitcoin according to Chainalysis researchers. This marks a significant escalation in their efforts to convert stolen cryptocurrency into more liquid assets.
The hackers' latest tactic involves converting stolen SOL (Solana) into BTC (Bitcoin), a process designed to move funds from a volatile, ecosystem-tied token into the most liquid cryptocurrency in the market. This conversion makes the funds easier to cash out through various means without attracting as much attention as moving large amounts of a single token would.
The operation hit a major roadblock when THORChain, a decentralized swapping platform, halted all transactions after discovering a critical block reorg bug. The bug created inconsistencies in the blockchain state, preventing accurate tracking of asset movements and making it impossible to process swaps reliably.
This technical disruption effectively creates a bottleneck in the hackers' laundering pipeline. While THORChain's systems automatically halted swaps, the hackers now must find alternative pathways to complete their conversions, potentially drawing more attention to their activities as they seek workarounds.
The shift to Bitcoin conversion signals the hackers are learning from previous law enforcement actions that target smaller, more traceable tokens. Bitcoin's deep liquidity pools and established mixing services make it an attractive destination for laundering stolen funds, despite being more closely monitored than privacy coins.
Blockchain analytics firms have been tracking the movement of stolen Solana tokens since the original hack, identifying multiple wallet addresses that received large amounts of SOL. The wallets have since been active in converting these holdings, suggesting a coordinated effort to maximize the value of stolen assets.
Chainalysis notes that this represents a sophisticated evolution in crypto crime, where hackers adapt their methods to stay ahead of blockchain analytics and law enforcement. The use of DeFi platforms like THORChain provides additional layers of complexity that can delay detection and complicate tracing efforts.
Investigators are now focusing on the blockchain traces left by the conversion process, hoping to identify any new wallet addresses or transaction patterns that could help recover funds or build stronger cases against those involved in the heist.