Stolen Binance Funds Laundered Through Thinly Traded Solana Tokens

By Marcus Bennett

Assets stolen in the $6.4 billion Binance hack moved through thinly traded Solana tokens before conversion to USD Coin (USDC), according to on-chain records. The attackers also routed roughly 117,000 NEAR, worth about $430,000, through newly created meme tokens on the NEAR blockchain.

The laundering pattern is simple on its face. The attackers swapped stolen Solana (SOL) into low-liquidity tokens. Then they converted those tokens into USDC. Each hop adds a layer between the stolen wallets and the cash-out point.

The NEAR leg followed the same playbook. Newly minted meme tokens carried the value through decentralized exchange liquidity pools. About 117,000 NEAR, roughly $430,000 at the time, passed through that route.

Why use liquidity pools to move stolen funds?

A liquidity pool lets one wallet deposit an asset while another wallet extracts value through token swaps. No direct transfer ever occurs between the two wallets. That is the entire appeal for a launderer.

The trades themselves stay visible on the blockchain. Nothing disappears. But the extra steps — swap into an obscure token, swap out to a stablecoin — take more work to trace than a straight transfer. Investigators must reconstruct each hop, and thinly traded tokens make the trail murkier still.

What does this change for tracing the Binance hack?

For the teams tracking the $6.4 billion theft, the answer is workload, not blindness. Every swap is recorded. Every pool is public. But meme tokens created specifically for the laundering route add friction, and low-volume tokens can obscure the size and timing of individual movements.

The mechanics matter for exchanges and stablecoin issuers too. The final hop into USDC means the funds eventually touch a regulated issuance point. That conversion is where freeze requests, blacklisting and law-enforcement coordination typically bite — which may explain why the attackers spread the process across multiple chains and multiple tokens rather than cashing out in one move.

The use of two distinct ecosystems, Solana and NEAR, shows pre-planned operational diversification. It also signals that on-chain forensics firms will need cross-chain tooling to map the full flow, not single-network analysis.

Expect the tracing effort to center on the USDC off-ramps in the coming weeks, since that is where the stolen funds re-enter supervised financial infrastructure.