The individual responsible for the high-profile Binance security breach continues to convert stolen Solana (SOL) into Bitcoin (BTC), according to new data from blockchain analytics platform Lookonchain. On November 4, Lookonchain reported that the attacker is actively transferring the illicit funds through a complex multi-step process involving various blockchain networks.
Cross-chain maneuvers increase asset privacy
The hacker’s strategy starts with splitting the stolen SOL across multiple wallets. Each batch is then sold for USD Coin (USDC), which is subsequently moved from the Solana blockchain to the Ethereum network. The hacker uses the transferred USDC to purchase Ethereum (ETH), before finally converting the acquired ETH to BTC through THORChain, a decentralized cross-chain liquidity protocol.
This approach allows the attacker to move and disguise assets by exploiting differences between blockchain ecosystems. As each cross-chain step introduces additional complexity, tracing the movement of the stolen funds becomes increasingly difficult for investigators.
Lookonchain documented a significant incident on November 1, noting that the hacker attempted to convert 970,522 SOL, with an estimated value of $95.9 million at the time, into Bitcoin. In one instance, the attacker carried out a rapid transaction involving 486,970 SOL, worth around $46.4 million, within a single hour.
The hacker splits SOL holdings among different wallets, sells them for USDC, moves USDC to Ethereum, acquires ETH, and ultimately exchanges the ETH for Bitcoin via decentralized protocols such as THORChain.
Use of decentralized protocols and efforts to freeze funds
Apart from THORChain, the attacker has utilized Relay Protocol, another service enabling cross-chain transfers, to facilitate the movement of stolen assets. These decentralized platforms offer additional layers of privacy and present challenges for authorities attempting to track and interdict the funds.
Despite ongoing law enforcement and exchange efforts, including asset freezes, the perpetrator appears determined to convert significant amounts of stolen crypto into Bitcoin. The latest official statement from Binance revealed that approximately $6.34 billion in digital assets have been impacted by the breach.
Binance reported that as of November 3, it has successfully frozen or intercepted $2.85 billion worth of stolen funds. Meanwhile, the Federal Bureau of Investigation (FBI) has requested that decentralized networks such as THORChain prevent transactions linked to the incident from being processed.
Despite asset freezes and law enforcement intervention, recent on-chain activity suggests that the attacker continues to move and exchange large sums using multiple decentralized and cross-chain services.
Ongoing risk highlights need for advanced monitoring
The continued movement of stolen assets across blockchain networks underscores the challenges in tracking illicit crypto transactions. With sophisticated methods involving several cross-chain protocols, the attacker is able to evade tracking and asset freezes to a certain extent.
For those closely watching this evolving case, monitoring asset flows across multiple networks and decentralized platforms is crucial. CryptoAppsy’s real-time charts and live news monitoring tools are designed to help users track large transactions like these, offering a more complete view of changing positions and developments as they occur.
