Binance hackers move 81% of stolen Solana, route funds via THORChain

The attackers did not leave the stolen Solana in one place. They split SOL across multiple wallets, moving it through a chain of conversions designed to shift the assets across networks and into different cryptocurrencies. This mattered because it continued the laundering process after the Binance exploit.

Lookonchain reported that the attackers sold SOL for USDC, bridged those funds to Ethereum, and used them to buy Ether. They then swapped ETH for Bitcoin through THORChain. Before expanding to Solana, the attackers had emptied most temporary holding wallets on Tron.

Blockchain data showed that tracked wallets still held 182,443 SOL, worth $16.9 million. That represented about 18.8% of the 970,522 SOL stolen. The movement of the remaining funds indicates that most stolen SOL had already been routed elsewhere, while investigators and service providers continued tracking the transactions.

The attackers moved roughly 81% of the Solana stolen in the Binance exploit. That figure shows how quickly the funds left the wallets being monitored by blockchain investigators. It also highlights the scale of the laundering operation compared with the original haul.

Arkham identified wallets grouped under the Binance hacker entity holding 182,443 SOL. The coins were worth $16.9 million at the time described. They represented about 18.8% of the 970,522 SOL stolen during the exploit. The remaining share had been moved from those tracked wallets.

This does not mean every moved coin had disappeared or become impossible to follow. Blockchain transactions remained visible, and investigators reported the routes through Solana, Tron, Ethereum and THORChain. However, moving funds across wallets, assets and blockchains complicated efforts to track and potentially recover them.

THORChain is a protocol for swapping cryptocurrency between different blockchains. It matters here because the Binance attackers could move value from one network to another while changing the asset itself. That added several steps between the stolen coins and the funds’ eventual form.

In this case, the attackers moved from Solana-related activity through USDC and Ethereum, then swapped Ether for Bitcoin using THORChain. A cross-chain swap can avoid a simple, single-network trail. Each transaction is still recorded, but investigators must connect activity across wallets, tokens and blockchains.

The article reports that North Korea-linked groups are suspected of using THORChain to launder proceeds from major hacks, including the $1.4 billion Bybit hack. THORChain halted some swaps after a refund bug was exposed, delaying the Binance attackers’ activity. Swaps later resumed on Bitcoin, Ethereum and several other chains.

The laundering route repeatedly changed both the asset and the blockchain. The attackers first split the stolen SOL across wallets and sold it for USDC. They then bridged that value to Ethereum, where they used it to buy Ether. This made the trail more complex than a direct transfer.

Lookonchain described the sequence as SOL to USDC, then a bridge to Ethereum, followed by an Ether purchase. The attackers ultimately swapped ETH for Bitcoin through THORChain. Each stage created new transactions and involved different wallets or networks. Blockchain investigators could still observe these movements, but they had to link the separate steps.

The route shows why cross-chain services mattered to the operation. It allowed the attackers to keep shifting stolen value while converting it into widely used cryptocurrencies. After THORChain resumed swaps, the laundering route could continue. The FBI urged crypto service providers and THORNode operators to block transactions connected to the stolen assets.

The laundering operation slowed when THORChain halted swaps. The halt followed an Ethereum block reorganization that exposed a refund bug. According to Chainalysis, the interruption unintentionally delayed the Binance attackers’ activity, temporarily removing a key route for exchanging assets across networks.

THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday. After services resumed, the attackers continued laundering funds through the protocol. Their reported route involved converting stolen Solana into USDC, moving value to Ethereum, buying Ether and swapping ETH for Bitcoin.

The episode shows how a technical decision by a crypto protocol can affect a criminal money trail. The halt did not recover the stolen funds; it only interrupted the route. The FBI had urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets. North Korea-linked groups were already suspected of using THORChain after major hacks.

The FBI said North Korea’s TraderTraitor hackers were behind the Binance attack. The attribution placed the exploit within a broader pattern of North Korea-linked cryptocurrency theft and laundering. Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the accusation as “absurd rhetoric.”

The FBI urged crypto service providers, including THORNode operators, to block transactions connected to the stolen assets. That request targeted the infrastructure the attackers used to move and exchange funds. THORNode operators are participants that help support THORChain’s cross-chain swaps.

The request came as the attackers continued moving stolen cryptocurrency through Solana, Tron, Ethereum and THORChain. North Korea-linked groups were suspected of using THORChain to launder proceeds from major hacks, including the $1.4 billion Bybit hack. Blocking linked transactions could disrupt the route, although the article does not report whether operators blocked the Binance funds.

Different blockchains keep separate transaction records, so moving value between them requires a bridge, a cross-chain protocol or an exchange. These systems can lock or receive assets on one network and release or swap equivalent value on another. They let users move between ecosystems without staying on one chain.

The Binance attackers used this kind of route. They split SOL across wallets, sold it for USDC, bridged the value to Ethereum, bought Ether and then swapped ETH for Bitcoin through THORChain. The funds therefore appeared across multiple assets, wallets and blockchains rather than following one direct path.

That fragmentation can make stolen funds harder to trace or recover because investigators must connect records across different systems and identify services handling the transfers. It does not erase the transaction history. In this case, Arkham, Lookonchain and Chainalysis still tracked movements, while the FBI asked providers and THORNode operators to block linked transactions.