Cryptoupdated 48m ago2 min read
Binance Hackers Launder 81% Of Stolen Solana Through THORChain After Swaps Resume
5outlets comparedWhere the coverage agrees
2 Other2 Western Alternative1 AsianThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
About 81% of the 970,522 SOL stolen has been moved and laundered through THORChain. About 182,443 SOL remained in hacker wallets, valued ~$16.9 million.
Save coverage image
Solana moved via THORChain
Binance hackers moved about 81% of the stolen Solana as they continued laundering assets through the cross-chain swap protocol THORChain after the protocol resumed swaps. Arkham data cited by Cointelegraph said wallets grouped under the Binance hacker entity held 182,443 SOL, or roughly 18.8% of the total 970,522 SOL stolen during the exploit.
Lookonchain said the attackers split the Solana across multiple wallets before converting it into USD Coin, then moved the USDC to the Ethereum network, bought Ether, and used THORChain to convert the funds into Bitcoin. The attackers behind the $6.3 billion Binance hack moved the stolen SOL as they continued laundering through THORChain after the protocol resumed swaps.
FBI pressure and North Korea denial
The Federal Bureau of Investigation attributed the Binance attack to North Korea’s TraderTraitor hackers and urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets. The FBI urged THORNode operators and decentralized finance services to block transactions tied to funds stolen from Binance.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as “absurd rhetoric.” Cointelegraph reported that THORChain resumed trading on Bitcoin, Ethereum and several other chains on Wednesday after services had been halted on Saturday after an Ethereum block reorganization exposed a refund bug.
Solana to Bitcoin, Gate freezes
Investigators said the laundering effort shifted again as Gate froze two accounts associated with the stolen funds following requests from US investigators. Within one hour the attackers moved 486,970 SOL, valued at approximately $46.4 million, toward Bitcoin swaps through Relay Protocol.
Gate subsequently confirmed that it had frozen two associated accounts and would cooperate with law enforcement, while the exchange did not disclose the amount frozen or confirm whether the accounts contained the full reported deposit. Traders Union said attackers largely emptied temporary Tron wallets used to launder funds and began shifting activity into Solana, where stolen tokens are being swapped for Bitcoin through Relay.