An estimated $6.3 billion in stolen funds. Hackers shifting strategy. And a race against the clock for US investigators.
According to data from Chainalysis, cybercriminals linked to the Binance hack have entered a new operational phase: the large-scale conversion of Solana (SOL) tokens into Bitcoin (BTC). A tactical pivot that is seriously complicating efforts to trace the funds.
Meanwhile, exchange Gate.io has announced the freezing of two accounts linked to these suspicious flows, as US authorities press platforms to act swiftly.
A Strategic Pivot to Bitcoin to Cover Their Tracks
The decision to convert SOL into BTC is far from arbitrary. Bitcoin remains the most liquid cryptocurrency in the world, with enormous trading volumes across hundreds of platforms. This deep liquidity allows hackers to more easily dilute their trail within the sheer volume of daily transactions.
Chainalysis, a firm specializing in on-chain analytics, has identified this behavioral shift as a major red flag. The move from Solana — a fast network that is relatively easier to trace thanks to its block explorer tooling — to Bitcoin points to an increasing sophistication in money laundering techniques. The threat actors are likely using mixers, cross-chain bridges, and decentralized exchanges to fragment the flows before reconsolidating them into BTC.
This type of scheme is well documented in major crypto cybercrime cases. The Lazarus Group, for example, has employed similar tactics following several large-scale hacks, routing funds through intermediary chains before converting to Bitcoin to facilitate cash-out via loosely regulated exchanges.
Gate.io Freezes Accounts as US Regulators Step Up
Exchange Gate.io has confirmed the freezing of two accounts directly linked to the flows identified by investigators. This swift response illustrates the growing pressure US authorities are placing on centralized platforms to take an active role in blocking illicit funds.
US investigators have formally requested that exchanges block any transaction associated with the wallet addresses identified in this case. A move that highlights the limits of the system: while regulated platforms may cooperate, hackers can always pivot toward decentralized protocols or exchanges operating in less cooperative jurisdictions.
The total amount at stake — $6.3 billion — places this hack among the largest in crypto history. The ability of authorities to freeze a meaningful portion of these funds will depend directly on how quickly platforms respond and on the precision of the on-chain analysis provided by firms such as Chainalysis and TRM Labs.
What This Case Reveals About the Maturity of Crypto Surveillance
This case highlights a reality that is often underestimated: the blockchain is traceable, but laundering remains possible if bad actors have enough time and resources at their disposal. The SOL to BTC conversion is a deliberate attempt to buy time against analytics tools that are advancing rapidly.
For exchanges and regulators alike, the challenge is now to bring that response window down from several days to just a matter of hours. Real-time on-chain monitoring tools, combined with emergency freeze protocols coordinated across platforms, represent the next frontier in the fight against crypto cybercrime. Gate.io has demonstrated that a rapid response is achievable — the question now is whether the rest of the industry will follow suit.
