Binance Hackers Launder Majority of Stolen Solana via THORChain

According to blockchain analytics firm Arkham, wallets associated with the Binance hackers currently hold 182,443 SOL—valued at about $16.9 million—which accounts for nearly 18.8% of the total 970,522 SOL taken during the attack.

Research from Lookonchain revealed that the hackers fragmented their SOL holdings across numerous wallets, converted the tokens into USDC stablecoins, bridged those assets onto the Ethereum network to acquire Ether (ETH), and then exchanged ETH for Bitcoin (BTC) using THORChain.

Binance disclosed that on Thursday, attackers infiltrated employee devices through fake job interviews and malware deployments, resulting in this unprecedented hack. By Tuesday, the exchange confirmed reimbursement of 98% of the stolen tokens and committed to covering any residual losses.

The U.S. Federal Bureau of Investigation attributed the attack to North Korean hackers from the group TraderTraitor on Saturday. They urged cryptocurrency service providers, including THORNode operators, to block transactions connected to the stolen funds.

Kim Yo Jong, sister of North Korea's leader Kim Jong Un, rejected these allegations, labeling them as 'absurd rhetoric.'

It is believed that North Korea-affiliated hacking entities regularly exploit THORChain to launder proceeds from major crypto heists, such as the Bybit hack valued at $1.4 billion.

On Wednesday, THORChain resumed swaps for Bitcoin, Ethereum, and other blockchains following a Saturday suspension triggered by an Ethereum block reorganization that exposed a refund vulnerability. Chainalysis noted the suspension inadvertently slowed the Binance hackers’ laundering activity.

Blockchain analyst SomaXBT estimated that approximately 54% of over 47,600 transactions executed by the attackers on Tron and Solana networks were automated.

Following the emptying of most of their interim wallets on Tron, the Binance hackers intensified their laundering operations on Solana by Sunday. Chainalysis calculated that nearly $500 million in value passed through the Tron network, including multiple transfers between wallets.

why

This investigation highlights how hackers employed advanced multi-chain laundering techniques to obscure stolen funds, underlining the persistent threat that large-scale breaches pose to the security and integrity of the cryptocurrency ecosystem.