The Solana conversions follow a rapid series of onchain liquidations in which the attacker swapped stolen altcoins primarily into Ether, including a botched trade earlier Sunday that dumped 908,793 PROM worth about $5 million into a nearly empty Uniswap V2 liquidity pool for just 0.0316 ETH, or $71. On Oct 31, the FBI attributed the theft to North Korea’s TraderTraitor hacking group after investigators including ZachXBT and Chainalysis observed funds from the Binance breach commingling via THORChain with proceeds from September’s $388 million Bitget exploit. Working alongside the US Secret Service and IRS Criminal Investigation, the FBI published a list of attacker-controlled addresses and urged THORNode operators, RPC node operators, DeFi platforms and instant swap services to block transactions tied to the laundering effort.

President Donald Trump said late Saturday that US officials were still reviewing the attribution, adding, “We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it.” Binance co-founder Changpeng Zhao credited US law enforcement agencies with helping track and freeze stolen assets, which total about $3 billion locked onchain by stablecoin issuers and ecosystem partners. Binance has replenished 95% of the stolen assets, or $6 billion, using $6.34 billion allocated from its corporate treasury, futures insurance fund and Secure Asset Fund for Users as remaining networks undergo security checks.