Binance Hackers Move 81% of Stolen SOL, Route Funds Through THORChain

The attackers behind the $6.3 billion Binance hack have moved approximately 81% of the stolen Solana, continuing to launder assets through the cross-chain swap protocol THORChain after it resumed operations. On-chain analytics firms Arkham and Lookonchain traced the movements, which leave just a fraction of the original haul sitting in identifiable wallets.

How much stolen Solana remains?

Wallets grouped under the Binance hacker entity held 182,443 SOL, worth roughly $16.9 million, as of the latest Arkham data. That figure represents about 18.8% of the 970,522 SOL taken during the exploit. In plain terms, more than four out of every five stolen SOL tokens have already left the attackers' original positions.

Lookonchain reported on Wednesday that the attackers split the SOL across multiple wallets, following a consistent laundering pipeline:

• Selling SOL for USDC
• Bridging the proceeds to Ethereum to purchase Ether
• Swapping ETH for Bitcoin (BTC) via THORChain

The pattern mirrors the playbook seen in prior North Korea-linked operations. The takeaway: the funds are not idle, and the conversion chain is deliberate.

Who does the FBI blame?

The US Federal Bureau of Investigation attributed the attack on Saturday to North Korea's TraderTraitahacker group — formally, TraderTraitor — and urged crypto service providers, including THORNode operators, to block transactions linked to the stolen assets. The bureau's advisory effectively widens the compliance perimeter beyond exchanges to the node operators that power cross-chain infrastructure.

The attribution drew a political response. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as "absurd rhetoric." Her statement does not address the on-chain evidence; it denies the framing. The takeaway: attribution is contested diplomatically, but the blockchain record stands on its own.

What role did THORChain's outage play?

THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday, after halting services on Saturday. An Ethereum block reorganization had exposed a refund bug, forcing the shutdown.

The halt inadvertently delayed the Binance hackers' laundering activity, according to Chainalysis. In other words, a technical failure on the laundering route briefly worked as a brake that no enforcement action had managed to apply. Whether node operators will now comply with the FBI's request to block tainted transactions remains an open question; THORChain's permissionless design makes refusal easy and enforcement difficult.

North Korea-linked groups are suspected of using THORChain to launder proceeds from some of the largest cryptocurrency thefts, including the $1.4 billion Bybit hack. The protocol is becoming a recurring chokepoint, not a one-off venue.

How automated was the operation?

Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated. Slightly more than half the activity ran on scripts, which suggests planning rather than improvised movement.

The hackers expanded to Solana on Sunday after emptying most of their temporary holding wallets on Tron. Chainalysis estimated roughly $500 million in total value moved through Tron, including repeated transfers between wallets — a figure inflated by churn between the attackers' own addresses rather than clean exit liquidity.

What is Binance's recovery position?

Binance suffered the record-setting hack on Thursday after attackers compromised employee devices through fake job interviews and malicious software downloads, the exchange said. The social-engineering vector places the breach in the supply-chain and insider-threat category, not a smart-contract failure.

Binance said Tuesday it had replenished 98% of affected tokens and would absorb remaining losses itself. The promise covers customer balances; it does not recover the stolen assets, most of which remain in the attackers' control. The takeaway: depositors are largely whole, but the criminal proceeds are still moving.

The window for THORNode operators and other service providers to act on the FBI's advisory is now — each day of inaction lets a larger share of the $6.3 billion convert into harder-to-trace Bitcoin.