Attackers behind the Binance hack have moved about 81% of the stolen Solana (SOL), continuing to launder assets through the cross-chain swap protocol THORChain, according to blockchain data and monitoring firms cited in the report.
Arkham data showed wallets grouped under the attackers held 182,443 SOL, worth $16.9 million. That represents roughly 18.8% of the 970,522 SOL stolen in the exploit. Lookonchain said the attackers split SOL across multiple wallets, sold it for USDC, bridged the funds to Ethereum to buy Ether, and then swapped ETH for Bitcoin through THORChain.
THORChain restored swaps for Bitcoin, Ethereum and several other chains on Wednesday. The protocol had halted services on Saturday after an Ethereum block reorganization revealed a refund bug. The pause delayed the attackers’ laundering activity, according to Chainalysis.
The FBI attributed the attack to North Korea’s TraderTraitor hackers and urged crypto service providers, including THORNode operators, to block transactions linked to the stolen funds. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, dismissed the accusations as “absurd rhetoric.”
The attackers had also moved funds through Tron. Chainalysis estimated that about $500 million in total value passed through the network, including repeated transfers between wallets. Investigator SomaXBT estimated that around 54% of the attackers’ more than 47,600 transactions on Tron and Solana were automated.
Sources: Cointelegraph.