Binance hackers move 81% of stolen Solana through THORChain

The wallets tied to the Binance exploit have now moved about 81% of the stolen Solana, with the funds routed through THORChain as the laundering pattern keeps shifting across chains. For high-risk PSPs, the relevant point is simple: cross-chain swap rails are being used at scale to break up and repackage stolen assets fast enough to make interdiction a moving target.

1. According to Arkham, wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million, which is roughly 18.8% of the total 970,522 SOL stolen during the exploit. The remaining balance suggests the attackers have already moved most of the Solana tied to the breach.
2. Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets, sold it for USDC, bridged to Ethereum to buy Ether, and then swapped ETH for Bitcoin (BTC) via THORChain. In other words, the laundering chain was not just a transfer, but a sequence of conversions designed to reduce traceability across networks.
3. Binance said its hack happened after attackers compromised employee devices through fake job interviews and malicious software downloads. The exchange said Tuesday that it had replenished 98% of affected tokens and would absorb losses.
4. The US Federal Bureau of Investigation attributed the attack on Saturday to North Korea’s TraderTraitor hackers and urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the accusations “absurd rhetoric.”
5. THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday after services were halted on Saturday following an Ethereum block reorganization that exposed a refund bug. Chainalysis said the halt delayed the Binance hackers’ laundering activity, while blockchain investigator SomaXBT estimated that about 54% of the attackers’ more than 47,600 transactions on Tron and Solana were automated.

Chainalysis also estimated that about $500 million in total value moved through Tron, including repeated transfers between wallets. That matters because the operational playbook here is not a single exchange cash-out, but repeated cross-chain hops, temporary holding wallets, and automated transaction flow across multiple rails.