Hackers Behind Binance Breach Transfer 81% of Looted Solana Through THORChain
Those responsible for the Binance attack have transferred approximately 81% of the SOL tokens they stole, retaining under $16.9 million in wallets monitored by Arkham Intelligence while continuing their money laundering operations through THORChain.
Those responsible for the $6.3 billion security breach at Binance have transferred approximately 81% of the Solana (SOL) tokens they stole while continuing their asset laundering operations through THORChain, a cross-chain swap protocol.
According to blockchain data platform Arkham, digital wallets associated with the Binance hacker entity currently contain 182,443 SOL (valued at $16.9 million), representing approximately 18.8% of the total 970,522 SOL tokens stolen in the exploit.
On Wednesday, Lookonchain disclosed that the perpetrators divided the SOL across numerous wallets, converting it to USDC, then bridging to Ethereum for Ether purchases, before finally exchanging ETH for Bitcoin (BTC) through THORChain.
Binance experienced a record-breaking security breach on Thursday when attackers gained access to employee devices via fraudulent job interviews and malicious software downloads, as stated by the exchange. On Tuesday, Binance announced it had replenished 98% of the affected tokens and would absorb the losses.
On Saturday, the US Federal Bureau of Investigation linked the attack to TraderTraitor hackers from North Korea and called on cryptocurrency service providers, including THORNode operators, to prevent transactions connected to the stolen assets.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, rejected the accusations as "absurd rhetoric."
Hacking groups associated with North Korea are believed to utilize THORChain for laundering stolen cryptocurrency from some of the industry's largest breaches, including the $1.4 billion Bybit hack.
THORChain resumes swaps after halt delayed laundering
On Wednesday, THORChain reinstated trading functionality on Bitcoin, Ethereum and multiple other chains. Operations had been suspended on Saturday following an Ethereum block reorganization that revealed a refund bug. According to Chainalysis, the suspension unintentionally postponed the Binance hackers' laundering operations.
Blockchain investigator SomaXBT calculated that approximately 54% of the attackers' more than 47,600 transactions across Tron and Solana networks were automated.
On Sunday, Binance hackers broadened their laundering operations to include Solana after depleting the majority of their temporary holding wallets on Tron. Chainalysis calculated that approximately $500 million in total value flowed through Tron, including multiple transfers between wallets.