Binance hackers move 81% of stolen Solana, route funds via THORChain

04/11/2026 admin

The attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana (SOL) as they continue laundering assets through the cross-chain swap protocol THORChain.

Wallets grouped under the Binance hacker entity held 182,443 SOL (worth $16.9 million), or roughly 18.8% of the total 970,522 SOL stolen during the exploit, according to blockchain data platform Arkham.

Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets, selling it for USDC, bridging to Ethereum to buy Ether, and ultimately swapping ETH for Bitcoin (BTC) via THORChain.

Binance suffered a record-setting hack on Thursday after attackers compromised employee devices through fake job interviews and malicious software downloads, the exchange said. Binance said Tuesday it replenished 98% of affected tokens and would absorb losses.

The US Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor hackers on Saturday and urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets.

Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as “absurd rhetoric.”

North Korea-linked hacking groups are suspected of using THORChain to launder proceeds from some of the largest cryptocurrency hacks, including the $1.4 billion Bybit hack.

THORChain resumes swaps after halt delayed laundering

THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday. Services had been halted on Saturday after an Ethereum block reorganization exposed a refund bug. The halt inadvertently delayed Binance hackers’ laundering activity, according to Chainalysis.

Blockchain investigator SomaXBT estimated that about 54% of the attackers’ more than 47,600 transactions on Tron and Solana were automated.

Binance hackers expanded their laundering activity to Solana on Sunday after emptying most of their temporary holding wallets on Tron. Chainalysis estimated that about $500 million in total value moved through Tron, including repeated transfers between wallets.

Source