Binance Breach: Stolen Solana Converted to Bitcoin through THORChain
You can also read this news on BH NEWS: Binance Breach: Stolen Solana Converted to Bitcoin through THORChain In a sophisticated maneuver following a significant cyberattack on Binance, the pe
A
AnonymousCryptoCompass newsroom
November 4, 2026
2 min read
NEWS
Hero article visual / chart / editorial image
CryptoCompass editorial visual for altcoins coverage.
In a sophisticated maneuver following a significant cyberattack on Binance, the perpetrator continues converting stolen Solana assets to Bitcoin. On-chain data platform Lookonchain revealed on November 4th that the hacker is transferring funds across various wallets through a series of cross-chain transactions.
Cross-Chain Strategy Complicates Asset Tracking
According to Lookonchain, the attacker initially splits the Solana (SOL) assets into multiple wallets and exchanges them for USDC. The USDC is then transferred from the Solana network to Ethereum, converted to Ethereum (ETH), and ultimately swapped for Bitcoin via THORChain. Known for enabling swaps across different blockchains without intermediaries, THORChain eases asset transfers but complicates tracing.
The attacker’s multi-step process facilitates the movement of stolen crypto assets, making detection significantly harder across networks.
This method is not unprecedented; previously, blockchain data identified that the hacker used this approach to convert tens of millions of dollars worth of stolen SOL into Bitcoin.
High-Value Transactions Traced in Early November
On November 1st, Lookonchain reported that the attacker attempted to convert approximately 970,522 SOL, valued at around $95.9 million, into Bitcoin. In just one hour, a substantial transaction of 486,970 SOL, worth roughly $46.4 million, was executed. Earlier operations utilized the Relay Protocol instead of THORChain. Relay Protocol also supports cross-network crypto transfers. Latest figures show the hacker now leveraging multiple decentralized services to continue acquiring Bitcoin.
The FBI has requested platforms like THORChain to halt movements of funds linked to the attack.
Exchange’s Intervention Fails to Halt Fund Mobility
Despite Binance’s latest update indicating that approximately $6.34 billion of affected crypto assets were frozen or blocked as of November 3rd, ongoing chain data reveals the attacker is maneuvering the remaining funds across different networks. Investigations indicate a focus on converting these assets to Bitcoin, employing a multi-step strategy to evade detection.
Tokenized stock trading is once again hitting a familiar roadblock: the companies whose shares would be turned into blockchain instruments are increasingly pushing back on whether—and where—t
Is a 28% monthly slide already priced into ADA, or are sellers just warming up? This Cardano price prediction leans bearish while the price stays under $0.1919, a pattern also covered in thep
Binance has released new details about the $6.3 billion cryptocurrency theft in October, outlining how attackers infiltrated the exchange using a combination of social engineering and sophist