Key facts
- Wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million, or roughly 18.8% of the 970,522 SOL stolen, per Arkham.
- Lookonchain reported the attackers sold SOL for USDC, bridged to Ethereum to buy Ether, then swapped ETH for Bitcoin via THORChain.
- Binance said it replenished 98% of affected tokens and would absorb losses from the hack.
- The FBI attributed the attack to North Korea's TraderTraitor hackers and urged crypto service providers to block linked transactions.
- Kim Yo Jong, sister of Kim Jong Un, dismissed the accusations as "absurd rhetoric."
- Chainalysis estimated about $500 million in total value moved through Tron, including repeated transfers between wallets.
Attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana, continuing to launder assets through the cross-chain swap protocol THORChain, according to blockchain data platform Arkham. Wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million, or roughly 18.8% of the 970,522 SOL stolen during the exploit, Arkham said.
Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets, selling it for USDC, bridging to Ethereum to buy Ether, and ultimately swapping ETH for Bitcoin via THORChain. Binance suffered a record-setting hack on Thursday after attackers compromised employee devices through fake job interviews and malicious software downloads, the exchange said. Binance said Tuesday it replenished 98% of affected tokens and would absorb losses.
The US Federal Bureau of Investigation attributed the attack to North Korea's TraderTraitor hackers on Saturday and urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as "absurd rhetoric."
THORChain restored trading on Bitcoin, Ethereum and several other chains on Wednesday. Services had been halted on Saturday after an Ethereum block reorganization exposed a refund bug. The halt inadvertently delayed the Binance hackers' laundering activity, according to Chainalysis. Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated.
Binance hackers expanded their laundering activity to Solana on Sunday after emptying most of their temporary holding wallets on Tron. Chainalysis estimated that about $500 million in total value moved through Tron, including repeated transfers between wallets. North Korea-linked hacking groups are suspected of using THORChain to launder proceeds from some of the largest cryptocurrency hacks, including the $1.4 billion Bybit hack.