Binance hackers move 81% of stolen Solana, route funds via THORChain
The Binance attackers moved most of the stolen SOL and continued laundering funds through THORChain after the protocol resumed swaps.
The cybercriminals behind the massive $6.3 billion Binance hack have successfully moved approximately 81% of the stolen Solana (SOL) cryptocurrency, continuing their illicit fund laundering efforts through the cross-chain swap protocol THORChain. According to blockchain data provider Arkham, wallets associated with the Binance hackers held 182,443 SOL, representing around 18.8% of the total 970,522 SOL stolen during the attack.
The hackers dispersed the stolen SOL across multiple wallets, initially selling it for USDC and then bridging to Ethereum to acquire Ether. Ultimately, they swapped Ether for Bitcoin (BTC) via THORChain. Binance confirmed on Thursday that it had replenished 98% of the affected tokens, absorbing the losses itself. The US Federal Bureau of Investigation (FBI) recently attributed the attack to North Korea's TraderTraitor hackers, urging crypto service providers, including THORNode operators, to block transactions involving the stolen assets.
North Korean-linked hacking groups have been suspected of utilizing THORChain to launder proceeds from some of the largest cryptocurrency hacks, including a $1.4 billion breach at Bybit. THORChain recently restored trading for Bitcoin, Ethereum, and several other chains on Wednesday, after halting services on Saturday due to an Ethereum block reorganization that revealed a refund bug, inadvertently delaying the hackers' laundering activities.
Chainalysis estimated that around 54% of the attackers' over 47,600 transactions on Tron and Solana were automated.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
