The individuals behind the $6.3 billion Binance hack have reportedly laundered approximately 81% of the Solana (SOL) tokens taken during the incident, using the cross-chain swap protocol THORChain to facilitate their activity.
Details of the hack and ongoing laundering
Blockchain data platform Arkham revealed that wallets attributed to the Binance hacker entity still control 182,443 SOL, valued at $16.9 million. This represents about 18.8% of the total 970,522 SOL, which was stolen in the initial attack.
According to Lookonchain, the attackers divided their SOL holdings among a series of wallets. They then converted the SOL into USDC, moved funds to Ethereum to purchase Ether, and ultimately exchanged the Ether for Bitcoin (BTC) utilizing THORChain’s swapping functionality.
Binance, one of the world’s largest cryptocurrency exchanges, experienced its largest known breach on Thursday. The company stated that the attackers breached employee systems by conducting fake job interviews combined with the download of malicious software. Binance announced on Tuesday that it had replenished 98% of impacted tokens and would absorb the associated losses.
The US Federal Bureau of Investigation identified North Korea’s TraderTraitor group as responsible for the attack and called on cryptocurrency service providers, including THORNode operators, to deny transactions associated with the stolen assets.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied these allegations and described them as “absurd rhetoric.”
Groups tied to North Korea are believed to utilize THORChain for laundering proceeds from significant crypto heists, such as the $1.4 billion Bybit exploit.
Mini dictionary: THORChain is a decentralized cross-chain liquidity protocol that enables users to swap digital assets across different blockchains without centralized intermediaries. Its structure allows for direct trading between various coins like Bitcoin, Ethereum, and Solana.
THORChain swap services resume after temporary halt
THORChain resumed trading operations for Bitcoin, Ethereum, and several other networks on Wednesday. Services had been suspended since Saturday after an Ethereum block reorganization exposed a refund vulnerability, forcing the network to apply an emergency halt. According to blockchain analysis firm Chainalysis, this pause temporarily slowed the laundering process used by the Binance hackers.
Binance confirmed, “The affected tokens have been replenished and the platform has absorbed the losses,” as it addressed investors following the breach.
Blockchain investigator SomaXBT estimated that roughly 54% of over 47,600 flagged transactions conducted by the attackers on the Tron and Solana networks were automated processes.
The hackers extended their laundering activity to Solana on Sunday after moving most funds out of their temporary Tron wallets. Chainalysis calculated that Tron processed about $500 million in value, including repeated transfers between addresses.
| Network | Estimated Value Laundered | Main Activities |
|---|---|---|
| Solana | $16.9 million (remaining), $6.3 billion stolen | Converted to USDC, further swapped |
| Tron | $500 million (estimated) | Repeated intra-wallet transfers |
| Ethereum | Data not specified | Bridge to ETH, swap to BTC |
The FBI urged, “Crypto service providers, including THORNode operators, should identify and block any transactions tied to illicit assets from the Binance hack.”
