Binance drain, the Solana leg: how the stolen funds were laundered, and how more than $30 million left for other chains via CCTP

1. What happened

On 29 October 2026, assets were drained from several of Binance's "hot wallets" (the online wallets an exchange uses for day-to-day withdrawals). On 31 October the FBI issued an alert attributing the attack to North Korea and published a list of addresses that hold or held the stolen assets (FBI alert).

The losses span many chains. This article covers the Solana part. On-chain, Binance's Solana hot wallet sent 970,521.9 SOL in total to one wallet over 23 minutes, from 20:10 to 20:33 UTC on 29 October. That wallet is the only Solana address on the FBI's list.

2. A few terms first

• Wallets and token accounts: On Solana, tokens such as USDC are not held by the wallet itself but in a "token account" created for each wallet. Think of a bank customer (the wallet) with a separate account for each currency underneath.
• Swap: Exchanging one crypto asset for another. On Solana, the Jupiter exchange aggregator is widely used.
• USDC and freezing: USDC is a token designed to hold the same value as the US dollar (a stablecoin). Its issuer, Circle, can make USDC at an address used for crime unmovable (freeze it). A currency like SOL, on the other hand, cannot be frozen by anyone.
• CCTP: Circle's mechanism for moving USDC from one chain to another. USDC is destroyed (burned) on the source chain and the same amount is newly issued (minted) on the destination chain.
• Deposit token: The "receipt" token you get when you deposit assets into a lending service. Whoever holds the receipt can withdraw the deposited assets.

3. Following one strand of the money

The stolen SOL moved through hundreds of wallets. Here is one strand of about 6,000 SOL (roughly 570,000 dollars at the time), traced end to end using nothing but on-chain records. All times are 2 November, UTC.

1. 04:52 A wallet receives about 6,071 SOL from the attacker's receiving wallet.
2. 05:29 It swaps the whole amount to USDC, but has the USDC proceeds paid to a different wallet, not to itself.
3. 05:31–05:50 The USDC is scattered across about 60 wallets in several layers, then gathered back into a single account a few seconds at a time.
4. 05:53 The gathered USDC is swapped back to SOL, and again the SOL proceeds are paid to a different wallet.
5. 05:57–06:03 The SOL is deposited into the lending service Jupiter Lend, and the receipt is handed to a new wallet, which does the withdrawal.
6. 06:38–07:02 The withdrawn SOL bounces among about 100 wallets, then collects in one wallet as about 6,020 SOL. The Jupiter Lend step is repeated (deposit, hand over the receipt, withdraw from another wallet).
7. 07:29–09:27 The last wallet, plus two wallets that received SOL from it, swap the SOL to USDC bit by bit and send it to Noble via CCTP in 10 transfers. The USDC passes through dYdX and comes back to a different wallet on Solana (about 570,000 USDC in total).

It took about three hours from receipt to the first outbound transfer, and about four and a half hours to send everything out. In that time the funds passed through at least several dozen wallets, were swapped twice and went through lending twice. And in the end they did not leave Solana: they took a round trip through another chain and came back (how that works is explained in point ⑤ of section 4).

4. Why the detour? Five places where tracing tends to break

Anyone tracing stolen funds normally follows the records step by step: "A sent to B". The detour above deliberately picks places where that step-by-step approach fails.

① Swaps that pay the proceeds to another wallet
The seller's record only shows "SOL went into a swap"; the proceeds turn up in a wallet that looks entirely unrelated. A tracer that treats swaps as dead ends stops here. When the proceeds are paid in SOL, they are delivered to the other wallet by closing a temporary account, so many explorers (sites for viewing transaction records) do not show the real recipient.

② Scatter in small pieces, then regather at once
Because the funds are spread over about 60 wallets and gathered again seconds later, each transfer looks small. A method that follows the largest transfers first leaves them for later.

③ Handing the receipt to another wallet
The depositing wallet and the withdrawing wallet are different, so the only link between them is a single transfer of the receipt. Ignore the receipt as a worthless token and the chain breaks. The TRON side of the same incident showed the same pattern using the lending service JustLend.

④ Bouncing among 100 wallets
Who sent how much to whom becomes tangled, and it gets hard to tell which flow is the main one.

⑤ CCTP to another chain, or a round trip back
When USDC moves between chains, it disappears on the source chain and is newly issued at the destination. If the destination is Noble (a chain that issues USDC), it can be forwarded automatically to the trading service dYdX and from there back to Solana. The returning USDC shows up in another wallet as freshly issued money.

5. Where did the money leave to?

We checked every record of USDC leaving Solana via CCTP, one by one, against Circle's public data.

Media reports said about 1.46 million dollars went through Jupiter Lend and Circle's bridge (reported by Wu Blockchain, citing an on-chain analyst). That figure counts the money that made the round trip through Noble and dYdX and came back to Solana. In our records, USDC returning to Solana through this round trip came to 15 transfers and about 1.29 million dollars, close to the reported 1.46 million (the strand traced in section 3 is part of this round trip). Because it passes through lending along the way, though, how much of it is the stolen funds themselves is not settled. The "over 30 million dollars" in this article is what left for Ethereum and other chains, so the two figures count different things. Neither one is wrong.

6. What ChainAnalyzer now follows

Each of the five places above is somewhere our automated tracer actually stopped at least once. Here is what we changed.

• Swaps that pay another wallet: When swap proceeds arrive at a wallet other than the seller's, that wallet becomes the next hop. The temporary-account-closing pattern is recognised too. The swap counterparty (the market maker) is not traced, so that unrelated businesses are never marked as recipients of stolen funds.
• Receipts traced as value: Jupiter Lend receipts are treated as carrying the same value as the deposited asset, and the wallets they are handed to are followed (the same mechanism as for JustLend on TRON).
• Pass-through steps do not count toward depth: The tracer has a limit on how deep it follows. Steps that simply pass on almost the full amount received (① and ③ above, or whole-balance transfers within 24 hours) no longer count toward that limit. Steps that scatter funds into small pieces still count as before, so the line that keeps uninvolved people out is unchanged.
• CCTP destinations recorded: For every outbound transfer, Circle's public data gives the chain and address where it arrived, and that goes into the incident record. The Noble → dYdX round trip is linked using the forwarding destination in Circle's records.
• Visible in the charts: Destinations appear in the incident page's network graph and in the "Where the funds are" chart.

閉じる / Close

7. How we checked

• For every CCTP transfer, we confirmed against Circle's public data that it completed, who sent it and where it arrived.
• On the destination chains, we confirmed that the USDC was actually minted (the only difference being the CCTP fee).
• We compared our tracing results with the address list the FBI published on 31 October. We did not import the FBI's list; we follow the flow of funds step by step from Binance's wallets. As of 7 November 2026 (UTC), all 19 Bitcoin addresses the FBI listed, and 270 of its 608 Ethereum addresses, had also been found independently by our tracing. Most of the remaining Ethereum addresses are where funds were swapped back into ETH via exchange services after coming from other chains; tracing those routes is on our list of improvements.
• Starting from the 970,522 SOL that entered the attacker's receiving wallet, we added up the SOL and USDC flows to each sending wallet one by one, and capped what we counted at "the amount that can be explained by stolen funds alone" (anything mixed in from other money is not counted).
• Among the wallets whose landings were added automatically, those that would also have counted unrelated activity from before the landing (about 21.7 million dollars' worth) were excluded.

8. What happened on arrival: cat and mouse with the freeze

The issuer can freeze USDC, but SOL, lending receipts and money in transit through CCTP cannot be frozen. This route took its detours in unfreezable forms and cut the time spent as freezable USDC down to a few minutes.

For the USDC that arrived on other chains (the lower bound from section 5, about 31.27 million dollars), we also looked at what happened next at the 81 destination addresses (the same address on different chains is counted separately). Those addresses also held USDC that was not stolen, so each outflow was allocated in proportion to the share of stolen funds. Figures are as of 00:00 UTC on 8 November 2026.

(One address can send to several kinds of destination, so the counts do not add up to 81. The remaining ≈ $0.74M is money moved between destination addresses.)

• Straight on to the next step: The median time from USDC being minted via CCTP to that address sending it on was under a minute.
• Most of the ETH went to THORChain: Of the roughly 10,500 ETH received from swaps on Ethereum, at least 90% (about 10,000 ETH) was sent to THORChain (a service that swaps into assets on other chains), either directly or via one intermediate wallet.
• No direct exchange deposits found: Within the exchange addresses we know of, we found nothing sent directly from a destination address to an exchange deposit address.
• The freeze came too late: One destination address was frozen by Circle, but the last USDC had left it 26 minutes earlier, so the amount frozen was zero. None of the other destinations, nor the 277 addresses that received USDC directly from them, were frozen.

In other words, the USDC that reached other chains also spent only a very short time in a freezable form before being turned into ETH or into unfreezable assets on other chains. Without a way to identify the landing addresses and raise an alert within minutes, there is no chance to freeze the funds or to trigger identity checks when they are deposited at an exchange.

A note on the figures in this section: the allocation simply divides by the share of stolen funds in the USDC each destination received, which is less rigorous than the calculation in section 5. Much of the "other wallets" row comes from a wallet that may also carry other people's money. We have not yet confirmed what the funds became, and on which chains, beyond Chainflip and THORChain. The "90%" of ETH is a lower-bound estimate made address by address and is not converted to dollars.