Attackers behind the $6.3 billion Binance exploit have transferred roughly 81% of the 970,522 stolen SOL, laundering proceeds through THORChain after the cross-chain protocol restored trading on Wednesday. Wallets linked to the hack still hold 182,443 SOL ($16.9 million), representing 18.8% of the haul, according to Arkham data cited by Lookonchain.
Key Takeaways
- Hackers moved 81% of 970,522 stolen SOL ($6.3B total hack) via THORChain after protocol resumed swaps Wednesday.
- FBI attributed attack to North Korea's TraderTraitor group; urged THORNode operators to block illicit flows.
- 182,443 SOL ($16.9M, 18.8% of haul) remains in hacker wallets per Arkham data.
- Binance replenished 98% of user tokens; recorded $2.3B net inflows post-hack.
- THORChain halt (Sat–Wed) due to Ethereum reorg bug temporarily disrupted laundering.
Executive Intelligence Brief
Laundering Mechanics and THORChain's Role
Blockchain investigator Lookonchain reported Wednesday that the attackers split SOL across multiple wallets, selling it for USDC, bridging to Ethereum to buy Ether, and ultimately swapping ETH for Bitcoin (BTC) via THORChain. This cross-chain routing exploits THORChain's native asset swap functionality, which does not rely on wrapped tokens, making tracing and freezing more difficult for compliance teams.
The laundering activity was inadvertently delayed over the weekend when THORChain halted services on Saturday. An Ethereum block reorganization exposed a refund bug, prompting the protocol to pause trading on Bitcoin, Ethereum, and several other chains. Chainalysis confirmed the halt stalled the hackers' flow. Services resumed Wednesday, reopening the primary laundering venue.
Attribution and Law Enforcement Response
The US Federal Bureau of Investigation attributed the attack to North Korea's TraderTraitor hacking group on Saturday, urging crypto service providers — including THORNode operators — to block transactions linked to the stolen assets. North Korea dismissed the allegations; Kim Yo Jong, sister of leader Kim Jong Un, called the accusations 'absurd rhetoric.' TraderTraitor is also suspected of using THORChain to launder proceeds from the $1.4 billion Bybit hack.
Binance Remediation and Market Impact
Binance stated Tuesday it had replenished 98% of affected user tokens and would absorb the remaining losses. The exchange traced the breach to compromised employee devices via fake job interviews and malicious software downloads. Separately, Binance recorded $2.3 billion in net inflows, signaling returning user confidence despite the historic breach. Chainalysis estimated approximately $500 million in total value moved through the Tron network during the laundering process, with investigator SomaXBT estimating 54% of the attackers' 47,600+ transactions on Tron and Solana were automated.
Forward Outlook: Node Compliance and Residual Risk
The critical variable is whether THORNode operators — who validate and execute cross-chain swaps — implement the FBI's request to filter illicit flows. THORChain's decentralized governance model complicates enforcement; no single entity can unilaterally censor transactions without consensus. The remaining 182,443 SOL ($16.9 million) in hacker-controlled wallets represents the immediate residual exposure. Market participants should monitor on-chain flows for further bridging to Ethereum and BTC conversion, as well as any regulatory guidance targeting THORChain's validator set.
