Wallets linked to the October 29 Binance hack have reportedly begun using THORChain to convert stolen Solana (SOL) into Bitcoin (BTC), marking another development in efforts to move cryptocurrency taken during the record-breaking exchange breach.
On November 4, Wu Blockchain reported, citing blockchain analytics platform Lookonchain, that the attacker had begun routing stolen SOL through THORChain.
The reported activity follows earlier conversions through Relay Protocol, which investigators identified as a route for moving Solana-based assets into Bitcoin.
The Binance breach involved approximately $6.3 billion to $6.4 billion in unauthorized transfers across multiple blockchains, according to estimates from blockchain security firms. Although stablecoin issuers and industry partners have frozen billions of dollars in affected assets, substantial amounts remain under attacker control.
The latest transfers suggest that the perpetrators are continuing to move portions of the stolen cryptocurrency through decentralized infrastructure. However, the precise amount successfully converted into Bitcoin through THORChain has not been independently confirmed.
Stolen Solana Moves Through Cross-Chain Swapping Services
The attacker initially obtained approximately 970,500 SOL, valued near $96 million at the time of the breach. On November 1, blockchain investigator Lookonchain reported that approximately 486,970 SOL, worth $46.4 million, had moved from the identified attacker wallet.
The transfers coincided with attempts to exchange stolen Solana for Bitcoin through Relay Protocol. CoinDesk subsequently reported that the attacker had begun converting the larger stolen SOL position, while blockchain investigators continued tracing individual transactions.
The November 4 THORChain report indicates another potential route for those conversions. THORChain enables users to exchange native cryptocurrencies across supported blockchain networks without relying on a conventional centralized exchange.
Such infrastructure can facilitate legitimate asset transfers, but it can also be used by criminals attempting to move stolen funds between networks. Converting SOL into BTC complicates investigations because analysts must connect transactions across different blockchains and identify corresponding swap outputs.
The movement does not necessarily mean the attackers have sold the Bitcoin for cash. Bitquery’s November 3 investigation found that approximately 84% of the stolen SOL remained in the original attacker wallet or addresses directly funded by it.
The firm also identified smaller transfers involving approximately 41,000 SOL converted into USDC through additional wallets.
FBI Urges DeFi Platforms to Block Stolen Funds
The cross-chain activity follows warnings from US authorities about attempts to launder proceeds from the Binance breach. On October 31, the Federal Bureau of Investigation attributed the attack to TraderTraitor, a hacking operation associated with North Korea.
The agency urged cryptocurrency infrastructure providers, including THORChain node operators and decentralized finance services, to block transactions involving identified attacker-controlled addresses. North Korea has denied responsibility for the incident.
Blockchain investigators have separately documented substantial movement of stolen assets through Tron, Relay and other cross-chain services. Bitquery reported that THORChain’s Tron, Bitcoin and Ethereum routes remained halted on November 3, highlighting operational disruptions affecting some transfer pathways.
The company also estimated that approximately $2.7 billion in stolen assets had been frozen, while roughly $3 billion remained in attacker-controlled holdings as of November 3. Those figures reflect different measurement dates and methodologies from earlier industry estimates.
Importantly, THORChain’s appearance in the transaction trail does not establish that the protocol itself was compromised. The underlying security breach occurred at Binance, while decentralized swapping services are being examined as potential channels for moving the proceeds.
For investigators, identifying destination wallets and coordinating with exchanges remains essential to restricting further laundering. The latest activity demonstrates how stolen cryptocurrency can move between networks even after significant portions of an initial theft have been frozen.
Further blockchain analysis will be needed to determine how much SOL was converted through THORChain and whether the resulting Bitcoin reaches identifiable exchange deposit addresses.
