Binance hacker swaps stolen Solana for Bitcoin using THORChain
The attacker behind the $6.3 billion exploit is moving funds through multiple blockchains to hide the trail of the largest heist in crypto history.
Key takeaways
- 1$6.3 billion was stolen from Binance in the largest heist in crypto history.
- 2Hackers are using THORChain to convert stolen Solana into Bitcoin.
- 3Approximately $2.85 billion of the stolen funds have been frozen or seized.
The hacker behind the $6.3 billion Binance security breach began converting stolen Solana into Bitcoin on 4 November. According to data from Lookonchain reported by Wu Blockchain, the attacker is moving funds through a series of intermediate steps to hide the transaction trail. The process involves dispersing the illicit assets across numerous digital wallets before executing the swaps.
The attacker first sold the stolen SOL for the USDC stablecoin. These funds were then bridged from the Solana network to Ethereum to purchase ETH. Finally, the hacker is using the decentralised liquidity protocol THORChain to swap the ETH into Bitcoin. This follows earlier attempts to move funds that were slowed by network technicalities on the Ethereum blockchain.
The breach is the largest in the history of the industry, involving more than 12,000 wallets and 40,000 transactions. Earlier reporting by YourKhabri on 1 November linked the activity to North Korean hacking groups. While firms like Elliptic and Tether have successfully frozen about $2.85 billion of the stolen assets, billions more remain in the attacker's control. Bitcoin currently trades at $76,706 with a market value of $1,542.2 billion.
The move to THORChain suggests the hacker is seeking decentralised routes that are harder for authorities to block than centralised exchanges. Security analysts will watch for further freezes by stablecoin issuers or protocol-level interventions to halt the laundering process. The continued movement of such large sums often creates selling pressure on the original assets and increases scrutiny on the security of cross-chain bridges.
Also reported by
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.