Binance hackers move 81% of stolen SOL, route funds through THORChain
In brief
- Hacker wallets still hold 182,443 SOL, about 18.8% of the stolen total, per Arkham data.
- Lookonchain traced a SOL-to-USDC-to-ETH-to-BTC route through THORChain.
- FBI attributed the hack to North Korea's TraderTraitor; Kim Yo Jong dismissed the accusations.
- Binance said it replenished 98% of affected tokens and would absorb the losses.
Where the SOL went
Wallets grouped under the Binance hacker entity held 182,443 SOL (worth $16.9 million), according to Arkham, as reported by Cointelegraph. That's roughly 18.8% of the total. The rest has moved.
Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets, sold it for USDC, bridged to Ethereum to buy ETH, then swapped that ETH for BTC via THORChain. Solana wasn't the first stop, either (the hackers expanded their laundering activity to it on Sunday after emptying most of their temporary holding wallets on Tron). Chainalysis estimated about $500 million in total value moved through Tron, including repeated transfers between wallets.
Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated.
THORChain's pause and restart
THORChain halted services on Saturday after an Ethereum block reorganization exposed a refund bug. According to Chainalysis, that halt inadvertently delayed the hackers' laundering activity. It didn't last. THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday, the same day Lookonchain flagged the ETH-to-BTC swaps.
It's not new territory for the protocol. North Korea-linked hacking groups are suspected of using THORChain to launder proceeds from major crypto hacks, including the $1.4 billion Bybit hack.
Attribution and Binance's response
Binance said attackers compromised employee devices through fake job interviews and malicious software downloads in the Thursday hack. The FBI attributed the attack to North Korea's TraderTraitor hackers on Saturday and urged crypto service providers (THORNode operators included) to block transactions linked to the stolen assets.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as
"absurd rhetoric."
Binance said on Tuesday that it had replenished 98% of affected tokens and would absorb the losses.
Frequently asked questions
How are the Binance hackers laundering the stolen SOL?
Lookonchain reported that the attackers split SOL across multiple wallets, sold it for USDC, bridged to Ethereum to buy ETH, and swapped that ETH for BTC via THORChain. SomaXBT estimated about 54% of their more than 47,600 transactions on Tron and Solana were automated.
How much stolen SOL do the Binance hackers still hold?
According to Arkham, wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million. That's about 18.8% of the 970,522 SOL stolen, meaning roughly 81% has been moved.
Did the THORChain halt affect the Binance hackers?
THORChain halted services on Saturday after an Ethereum block reorganization exposed a refund bug. Chainalysis said the halt inadvertently delayed the hackers' laundering activity. The protocol restored trading on Bitcoin, Ethereum and several other chains on Wednesday.
