SomaXBT Flags Automation Signs in 54% of Binance Theft Transactions

On-chain investigator SomaXBT identified patterns consistent with automation in about 54% of 47,644 transactions involving stolen Binance funds on Tron and Solana, tracing one route through lending and swap services.

The percentage refers to transactions reviewed, not the share of stolen assets moved. SomaXBT pointed to funds forwarded within 60 seconds of arrival and multiple wallets transacting in the same block. The assessment rests on timing and repeated behavior; automation has not been directly confirmed.

In one Nov. 3 sequence, funds passed through 34 intermediary wallets before 31,976 Solana (SOL) was deposited into Jupiter Lend. Deposit receipts moved to new wallets, which used them to withdraw SOL from the lending pool.

The wallets then swapped 27,060 SOL for about 2.487 million USDC through Jupiter RFQ. Some USDC moved through Circle’s cross-chain transfer protocol within tens of seconds of the swaps and reached accounts associated with dYdX. The sequence took about three and a half hours.

Binance estimated losses of about $6.3 billion after its hot wallets were compromised on Oct. 29. SomaXBT said the traced movements provide no evidence that Jupiter Lend, Circle or dYdX participated in laundering.