Blockchain tracking indicates the team behind Binance’s massive 2026 hack has continued moving and converting much of the stolen Solana-linked proceeds, with laundering flows increasingly rou
Blockchain tracking indicates the team behind Binance’s massive 2026 hack has continued moving and converting much of the stolen Solana-linked proceeds, with laundering flows increasingly routed through the cross-chain swap protocol THORChain.
According to Arkham data cited in reporting, wallets associated with the “Binance hacker” group now hold 182,443 SOL (about $16.9 million), and the broader attacker cohort has already moved roughly 81% of the 970,522 SOL reportedly stolen during the exploit—an amount linked to at least part of the laundering pipeline described by investigators.
The latest movement patterns come as researchers map how stolen assets are split across wallets, converted, and bridged across chains. Arkham’s entity-level monitoring, as referenced in the report, links a cluster of wallets to the Binance exploit and places their SOL holdings at 182,443 SOL—roughly 18.8% of the 970,522 SOL attributed to the hack.
Lookonchain, in its Wednesday update, described a multi-step path the attackers used: SOL was distributed across multiple wallets, then sold for USDC, after which the stablecoin proceeds were bridged to Ethereum to buy ether (ETH). The final step described involves swapping ETH for bitcoin (BTC) through THORChain, a cross-chain exchange designed to enable asset conversion without relying on traditional centralized order books.
For investors and traders, these details matter because they illustrate how hackers can turn a large, volatile crypto haul into multiple liquid representations across ecosystems—often before defenders can react or freeze funds. It also helps explain why cross-chain liquidity rails like THORChain frequently become a focus of monitoring during major incidents.
Binance disclosed that its systems were compromised after attackers gained access to employee devices using fake job interview lures and malicious software downloads. The exchange characterized the incident as a record-setting hack and said later that it replenished 98% of affected tokens and would absorb remaining losses.
On the investigative side, the U.S. Federal Bureau of Investigation (FBI) attributed the attack on Saturday to North Korea’s TraderTraitor hackers, and urged crypto service providers—explicitly including THORNode operators—to block transactions linked to stolen assets.
North Korea’s response was swift. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the FBI’s accusations as “absurd rhetoric,” according to coverage linked in the source reporting.
While attribution disputes are not unusual in cyber cases, what is notable here is the operational specificity: regulators and investigators have pushed for targeted transaction blocking across parts of the cross-chain infrastructure, suggesting authorities believe the laundering route is not merely incidental.
THORChain’s ability to process swaps became part of the story once services were paused and later restored. Earlier coverage cited in the report notes that THORChain halted trading on Bitcoin, Ethereum, and other chains after an Ethereum-related issue: a block reorganization exposed a refund bug.
When THORChain resumed trading on Wednesday, the restart enabled cross-chain swaps to continue across multiple networks. Chainalysis, as referenced in the report, said the halt inadvertently delayed laundering activity tied to the Binance attackers—an important practical point. Even when hackers prepare multi-step plans, operational pauses in the rails they rely on can buy time for monitoring, coordination, and potential risk controls.
In parallel, analysts attempted to quantify the attackers’ execution style. SomaXBT estimated that around 54% of the attackers’ more than 47,600 transactions on Tron and Solana were automated, underscoring the likelihood of scripted swapping and distribution rather than purely manual movement.
The reported laundering pattern also points to geographic and chain-level flexibility. Binance hackers reportedly expanded activity to Solana on Sunday after emptying most of their temporary holding wallets on Tron. Chainalysis estimated that roughly $500 million in total value moved through Tron, including repeated transfers among wallets—behavior consistent with attempts to obscure fund provenance through rapid, iterative movement.
The report also situates THORChain within a broader, persistent laundering narrative. North Korea-linked hacking groups have been suspected of using THORChain in laundering proceeds tied to other major hacks, including the $1.4 billion Bybit hack mentioned in the source.
For readers, the key uncertainty going forward is whether authorities can effectively disrupt the laundering pipeline without impairing legitimate cross-chain use. The immediate watch items are (1) whether stolen-asset conversion continues to shift toward other liquidity venues, and (2) how quickly operational controls and monitoring tools can identify and deter repeat use of similar cross-chain routes.
This article was originally published as Binance Hackers Shift 81% of Stolen SOL, Use THORChain to Route Funds on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.
