Binance hack money launderers moved more than $500 million, about 670 billion won, on Tron and then broadened their activity to other blockchains including Solana.

On Nov. 1, blockchain outlet the Defiant reported that blockchain analytics firm Chainalysis said funds stolen in the Binance hack were dispersed on Tron on a large scale and then moved across multiple blockchains.

Chainalysis said the attackers used more than 1,000 addresses on Tron and made more than 3,000 deposits. Instead of keeping funds in a single wallet or a small number of routes, they split transfers across many addresses and deposits to complicate the trail.

Tron was used as a key intermediary in the laundering process. Chainalysis explained that the attackers moved funds held in Tron-based intermediary wallets to other networks via several decentralised finance (DeFi) protocols and cross-chain services. Chainflip, Relay and THORChain were mentioned as possible routes for the transfers.

The laundering activity later expanded to Solana. Chainalysis said not all of the $500 million moved from Tron flowed into Solana, and its disclosure did not confirm the specific amount sent to Solana.

The case shows that after large-scale cryptocurrency hacks, laundering is no longer confined to a single blockchain and is expanding to methods that pass through multiple networks and services. The use of more than 1,000 addresses and more than 3,000 deposits is seen as an attempt to complicate fund flows and make tracking more difficult.

A key point to watch is which routes the dispersed funds from Tron take on other blockchains including Solana. Another main focus for tracking is what role bridges and swap services that connect multiple chains play in the laundering process.