Mentioned in This Article
1. Where is the stolen Solana now?
Attackers behind the $6.3 billion Binance hack have moved roughly 81% of the Solana (SOL) they stole and are still laundering proceeds through the cross-chain protocol THORChain, according to on-chain data reported on November 4. Wallets that the analytics platform Arkham groups under a "Binance hacker" label held 182,443 SOL, about 18.8% of the 970,522 SOL taken.
Put simply, close to four-fifths of the Solana portion has already left the wallets where it was first parked. The remainder sits in addresses that analysts continue to watch, and the pattern of movement shows that the thieves are working through their holdings in stages instead of leaving them idle.
The Solana share is only one slice of a much larger theft. Binance has described the incident as a record hack, and it occurred on Thursday, October 29. The Solana movements are notable because they show the laundering effort extending across several networks at once, which makes the trail harder to follow and harder to freeze.
The 81% and 18.8% figures come from the tracking data and are consistent with each other, since the moved and unmoved shares together account for the full 970,522 SOL. They describe what was visible on-chain at the time of reporting and can change as the wallets continue to shift funds.
2. How are the hackers laundering the funds?
On-chain investigator Lookonchain reported on Wednesday that the attackers divided their SOL across many wallets. From there they sold the tokens for the dollar-pegged stablecoin USDC, bridged the proceeds to the Ethereum network, and bought Ether (ETH). The final step was to swap that Ether for Bitcoin (BTC) using THORChain.
Each stage has a purpose. Splitting funds across wallets makes individual transfers look smaller and less conspicuous. Converting to a stablecoin locks in value and removes the price swings of Solana. Bridging to Ethereum opens access to deep liquidity and many trading venues. Moving into Bitcoin through a cross-chain protocol then breaks the link between the stolen assets and the networks on which they were originally taken.
THORChain is a decentralized protocol that lets users swap assets between different blockchains without a centralized exchange acting as intermediary. That design has legitimate uses, but it is also attractive to people who want to avoid platforms that can freeze accounts. North Korea-linked hacking groups are suspected of using THORChain to launder proceeds from large thefts, including the $1.4 billion Bybit hack.
Researcher SomaXBT offered a sense of how mechanical the operation is. Their estimate was that about 54% of the attackers' more than 47,600 transactions on the Tron and Solana networks were automated. A figure like that points to scripts handling a large share of the repetitive transfers, which lets the group move funds quickly and in small pieces.
3. What did Binance and the FBI say about the attack?
Binance has said the attackers compromised employee devices through fake job interviews and malicious software downloads. In other words, the entry point was not a flaw in the exchange's core blockchain systems but a social engineering approach aimed at staff, a technique that relies on persuading a person to run something harmful.
On Tuesday the company said it had replenished 98% of the affected tokens and would absorb the losses itself. That commitment matters for customers, since it indicates that users are not expected to bear the cost of the theft, though the remaining two percent of affected tokens had not yet been restored in that update.
The Federal Bureau of Investigation attributed the attack on Saturday to TraderTraitor, a hacking group linked to North Korea. The agency urged crypto service providers, explicitly including operators of THORNode, the machines that run the THORChain network, to block transactions tied to the stolen assets. The request shows that law enforcement regards the laundering route, not only the original breach, as an area where intervention is possible.
North Korea has rejected the accusation. Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the claims as "absurd rhetoric." The attribution to TraderTraitor is the FBI's assessment, and the denial is on record alongside it.
4. Why did THORChain's pause matter?
THORChain restored trading on Wednesday for Bitcoin, Ethereum and several other chains. Its services had been halted on Saturday after an Ethereum block reorganization exposed a bug in how refunds were handled. A block reorganization occurs when a blockchain replaces recent blocks with a different version of history, which can leave dependent systems in a state they did not anticipate.
The timing of the halt, which began on the same day the FBI issued its attribution, had a side effect. Chainalysis said the pause inadvertently delayed the hackers' laundering activity. The stoppage was caused by a technical fault and not by a decision to cut off the thieves, but it still disrupted one of the channels they had been using.
With swaps switched back on, the attackers resumed using the protocol. The reporting describes them continuing to route funds through it after service returned, which puts renewed pressure on the network's operators and on the FBI's request that node operators decline to process transactions linked to the theft.
Whether node operators can or will refuse such transactions is a separate question. A decentralized protocol has no single party that can simply switch off specific users, so any block would depend on many independent operators choosing to comply, and the source material does not describe how many have done so.
5. How did the laundering spread across Tron and Solana?
Before the activity reached Solana, much of the movement ran through Tron. The attackers expanded their laundering to Solana on Sunday, after they had emptied most of their temporary holding wallets on Tron. Chainalysis estimated that about $500 million in total value passed through Tron, a figure that counts repeated transfers between wallets and therefore overstates the amount of unique money involved.
That caveat is important for reading the numbers. When funds are hopped through a chain of addresses, the same dollars can appear many times in transfer totals. The $500 million estimate describes the volume of activity, not an extra amount stolen on top of the headline loss.
The sequence also illustrates a common laundering pattern: use one network as a staging area, then shift to another as the first becomes crowded or monitored. The Tron wallets served as temporary holding addresses, and once they were largely drained the activity moved to Solana, where the SOL portion of the theft was then cut into pieces and sold.
Taken together with the automation estimate of more than 47,600 transactions, the picture is of a high-volume, high-speed operation designed to outpace manual review. Investigators face the challenge of tracking an enormous number of small transfers while exchanges and protocols decide whether to flag them.
6. What does the Binance hack mean for crypto security?
The incident reinforces a point that security researchers have made for years: the weakest link is often human. Fake job interviews and malicious downloads target employees rather than code, and a single compromised device can open the way to systems holding enormous value. Strong smart contract audits and robust cryptography do not protect against a staff member being tricked into installing harmful software.
For exchanges, the episode raises questions about how much authority any one device or employee account should carry, and about how quickly large movements can be detected and halted. For decentralized protocols, it renews a debate about their responsibility when illicit funds pass through them, given that they lack a central operator but are used in the laundering pipeline.
Speed is part of the problem. Once a large theft succeeds, defenders have a narrow window in which funds can still be frozen by centralized issuers and exchanges, and attackers know it. That is why automated scripts, rapid chain-hopping and conversion into assets such as Bitcoin figure so heavily in these operations, and why public tracking by independent analysts has become an important early warning layer for the industry.
For ordinary users, the most immediate takeaway is Binance's statement that losses will be covered. The company said it had already replenished 98% of affected tokens, which suggests customer balances are being restored even as the investigation continues.
The comparison with the Bybit theft, which the same type of suspected actors are linked to, indicates that the biggest crypto thefts in recent years follow a recurring model: compromise the operator, move funds quickly across chains, and convert into assets that are harder to freeze. Each such case adds to the body of evidence that investigators and compliance teams use to anticipate the next one.
7. What happens next?
The most closely watched development is where the remaining 182,443 SOL goes. If it follows the route already seen, it will be sold for stablecoins, bridged, converted into Ether and then swapped into Bitcoin through THORChain, giving investigators further chances to trace and flag the transfers.
Attention will also fall on THORChain's operators and node runners. The FBI has asked providers to block transactions linked to the stolen assets, and the protocol is processing swaps again after Wednesday's restart. How many operators act on that request, and whether swaps tied to the theft continue to clear, will indicate how effective the appeal is.
Binance, for its part, has about two percent of affected tokens still to replenish by its own account, and further updates from the company on that process and on the investigation are likely. Analytics firms including Arkham, Lookonchain and Chainalysis are continuing to publish findings, so the figures cited here, including the 81% share of Solana already moved, are likely to change as new data appears.