Binance Hackers Move 81% of Stolen Solana via THORChain

The individuals responsible for the record-setting Binance security breach have shifted approximately 81% of the compromised Solana assets. Analysts examining the activity noted that the movement of funds persisted as the cross-chain swap protocol THORChain resumed normal operations.

Blockchain data compiled by Arkham indicated that wallets associated with the Binance hackers retained 182,443 SOL, valued at $16.9 million. This figure represents about 18.8% of the total 970,522 SOL taken during the initial exploit. On Wednesday, Lookonchain reported that the perpetrators divided the stolen SOL across various wallets, converted the tokens into USDC, bridged the capital to Ethereum to acquire Ether, and subsequently exchanged ETH for Bitcoin using THORChain.

Understanding the Binance Solana Laundering Route

Binance encountered the massive security breach on Thursday after attackers compromised employee devices via fraudulent job interviews and malicious downloads. By Tuesday, the exchange confirmed it had replenished 98% of the impacted tokens and committed to absorbing all financial losses. On Saturday, the United States Federal Bureau of Investigation pointed to North Korea’s TraderTraitor hacking group as the source of the incident, urging service providers and THORNode operators to block addresses tied to the stolen funds. Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected these allegations as groundless rhetoric.

North Korea-associated hacking collectives are suspected of utilizing THORChain to launder proceeds from multiple major cryptocurrency incidents, including a prior $1.4 billion Bybit breach. THORChain brought trading back online for Bitcoin, Ethereum, and additional chains on Wednesday following a temporary service suspension. The downtime originated on Saturday after an Ethereum block reorganization triggered a refund bug. According to Chainalysis, this mandatory halt inadvertently delayed the laundering efforts of the Binance attackers.

Hackers behind the Binance breach have moved 81% of stolen Solana while laundering assets via THORChain.

Investigative findings from SomaXBT revealed that nearly 54% of the actors' transactions exceeding 47,600 across the Tron and Solana networks involved automation. The illicit actors previously shifted their laundering operations to Solana on Sunday following the depletion of temporary holding wallets on Tron. Chainalysis estimated that approximately $500 million moved across the Tron network throughout the repeated wallet transfers.

Why it matters

The ongoing movement of stolen digital assets highlights continued vulnerabilities within cross-chain protocols and automated laundering networks. This activity directly impacts crypto service providers, exchange security protocols, and regulatory oversight regarding decentralized liquidity platforms.