Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay

The $6.3 billion Binance-linked theft has moved through a familiar pattern for crypto's largest hacks: stolen tokens get broken into thousands of small transfers across a chain known for cheap, fast settlement before bridging elsewhere. Chainalysis found the Tron leg alone spanned more than 1,000 addresses and over 3,000 deposits, a scale built specifically to outpace manual tracing and to test which platforms will freeze funds versus which will simply process them.

For exchanges and bridges, the practical choice is now binary: screen and block, or process and risk becoming the next complicit node. Gate froze two accounts at U.S. investigators' request, and Relay says it is screening hacker-linked addresses while insisting ordinary users face no disruption. For the attacker, each new chokepoint narrows the path to clean Bitcoin, though $279 million in altcoins had already been converted before the SOL swaps were even flagged.

Relay's position, that it blocks bad actors while changing nothing for everyone else, is the same claim every bridge makes when it turns into a filter. It is a defensible emergency measure, but it exposes how much discretionary power sits with a handful of protocol operators over supposedly permissionless rails. Cross-chain infrastructure built to move value without gatekeepers is, in practice, only as resistant to pressure as the company running the screening list. (per thedefiant.io)

Whether this laundering trail dead-ends or simply adapts again now depends on how much of the 486,970 SOL actually clears into Bitcoin before Relay's screening catches it, and on whether more exchanges follow Gate in freezing related accounts. Chainalysis and Binance continuing to publish address-level detail will determine if investigators stay a step ahead or if the funds disperse into venues with looser cooperation.