TL;DR:
- Laundering progress: Binance Hackers moved about 81% of stolen Solana through THORChain, while Arkham says wallets tied to them still hold 182,443 SOL worth $16.9 million.
- Swap route: Lookonchain says the Hackers split SOL, sold it for USDC, bridged to Ethereum, bought Ether, then swapped ETH for Bitcoin via THORChain.
- Investigation: The FBI blamed North Korea’s TraderTraitor group, Kim Yo Jong dismissed the claim, and Chainalysis said a THORChain halt briefly slowed the laundering.
Blockchain trackers say the group behind the $6.3 billion Binance breach has routed roughly 81% of its stolen Solana through THORChain. Arkham data shows wallets tied to the Binance Hackers still hold 182,443 SOL, about $16.9 million, and 18.8% of the 970,522 SOL taken in the exploit.
Swap Path Turns SOL Into Bitcoin
Lookonchain reported Wednesday that the Binance Hackers split the SOL across several wallets, sold it for USDC, bridged to Ethereum to buy Ether, then swapped ETH for Bitcoin through THORChain. The breach hit Binance last Thursday after staff devices were compromised through fake job interviews and malicious downloads, the exchange said. Binance added Tuesday that it had replaced 98% of affected tokens and would absorb the losses.
The Binance hacker continues to swap $SOL for $BTC!
They're splitting the $SOL across multiple wallets and selling it for $USDC.
Then they bridge the $USDC to Ethereum and buy $ETH.
Finally, they swap the $ETH for $BTC via #THORChain.https://t.co/2qK0H97eUW pic.twitter.com/LrBmaI06yi
— Lookonchain (@lookonchain) November 4, 2026
The FBI blamed North Korea’s TraderTraitor group on Saturday and asked crypto providers, including THORNode operators, to block assets linked to the theft. Kim Yo Jong, sister of North Korean leader Kim Jong Un, called the allegation “absurd rhetoric.“ North Korea-linked groups have previously been suspected of using THORChain to clean proceeds from major crypto hacks, including the $1.4 billion Bybit incident.
THORChain Restart and Tron Trail
THORChain resumed trading on Bitcoin, Ethereum and other chains Wednesday after a Saturday halt caused by an Ethereum block reorganization that exposed a refund bug. Chainalysis said that pause briefly slowed the Binance Hackers. SomaXBT estimated that about 54% of the Binance Hackers’ more than 47,600 transactions on Tron and Solana were automated.
The Binance Hackers widened laundering to Solana on Sunday after clearing most temporary Tron wallets. Chainalysis put about $500 million in total value moving through Tron, including repeated transfers between wallets. Arkham’s figure leaves 18.8% of the stolen SOL in wallets linked to the Binance Hackers. Lookonchain’s account shows the Binance Hackers used a multi-step route rather than a direct sale.
The Binance Hackers’ Bitcoin purchases came after the Ether leg of the transfers. THORChain’s restart allowed the Binance Hackers to resume swaps that had been delayed. Their Tron activity accounted for a large share of the $500 million cited by Chainalysis. The figures come from blockchain data cited by the trackers.
