The perpetrators behind the unprecedented $6.3 billion Binance security breach have significantly advanced their money-laundering operations, successfully funneling approximately 81% of the stolen Solana tokens through cross-chain protocols. According to on-chain intelligence provided by blockchain data platform Arkham, wallets closely associated with the Binance hacker entity currently hold just 182,443 SOL, valued at roughly $16.9 million. This remaining balance accounts for a mere 18.8% of the total 970,522 SOL originally plundered during the massive multi-chain exploit.
Blockchain analytics firm Lookonchain reported that the malicious actors methodically fragmented the stolen SOL holdings across a multitude of disparate wallets. From there, the assets were systematically sold off for USD Coin (USDC), bridged over to the Ethereum network to acquire Ether (ETH), and ultimately converted into Bitcoin (BTC) utilizing the decentralized cross-chain liquidity protocol THORChain. This sophisticated, multi-step obfuscation strategy highlights the attackers’ reliance on automated cross-chain mechanisms to sever the transactional lineage of the stolen funds.
The sprawling cyberattack unfolded on Thursday, marking what is widely considered the largest security breach in cryptocurrency history. According to disclosures from Binance, the attackers gained unauthorized access to the exchange’s systems by systematically compromising employee devices. The vector of entry involved elaborate social engineering tactics, specifically utilizing fake job interview scenarios paired with malicious software downloads designed to compromise internal endpoints. Despite the catastrophic scale of the theft, Binance announced that it has successfully replenished 98% of the affected user tokens and committed to absorbing the full financial losses internally to protect its customer base.
In the wake of the incident, international cybersecurity authorities swiftly mobilized. The United States Federal Bureau of Investigation (FBI) formally attributed the multi-billion-dollar breach to TraderTraitor, a notorious cybercrime collective linked to North Korea. In an alert issued on Saturday, the federal agency strongly urged global cryptocurrency service providers, including THORNode operators, to proactively monitor and block any incoming or outgoing transactions associated with the stolen asset addresses.
The attribution, however, has met with fierce diplomatic pushback from Pyongyang. Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, issued a public statement dismissing the accusations as absurd rhetoric designed to shift blame. Despite official denials, international security analysts and blockchain forensics firms have repeatedly flagged North Korea-linked hacking groups for leveraging protocols like THORChain to launder proceeds stemming from the industry’s most lucrative exploits, including the previous $1.4 billion Bybit security breach.
THORChain Resumes Swaps After Halt Delayed Laundering
The movement of funds faced a temporary, albeit significant, logistical bottleneck last week following operational disruptions on THORChain. The decentralized protocol formally restored trading capabilities for Bitcoin, Ethereum, and several other supported blockchains on Wednesday. Services across the network had been abruptly halted on Saturday after an unexpected Ethereum block reorganization exposed a critical refund bug within the protocol’s architecture.
While the sudden outage created operational challenges for regular liquidity providers and traders, blockchain intelligence firm Chainalysis noted that the emergency protocol halt inadvertently threw a wrench into the hackers’ laundering schedule. The unexpected downtime bought valuable time for investigators, slowing down the velocity at which the stolen capital could be bridged and swapped across disparate blockchains.
Further insight into the mechanics of the exploit came from independent blockchain investigator SomaXBT, who estimated that roughly 54% of the attackers’ staggering transaction volume—surpassing 47,600 individual transfers executed across the Tron and Solana networks—was executed via automated scripts. The heavy reliance on automation allowed the perpetrators to rapidly segment funds and evade immediate manual intervention from exchange compliance teams.
The shift toward Solana represents a distinct geographical and technical phase in the hackers’ post-exploit strategy. Binance hackers aggressively expanded their laundering operations to the Solana ecosystem on Sunday, immediately following the depletion of most of their temporary holding wallets on the Tron network. Chainalysis figures indicate that a cumulative value of approximately $500 million moved through Tron during the initial phases of the laundering effort, characterized by a dizzying cycle of repeated transfers designed to mask the ultimate destination of the funds before bridging to secondary assets.
Comments (0)