Binance hacker continues laundering stolen funds through THORChain route
Security & Exploits ·
The actor behind the $6.3 billion Binance exploit is still converting stolen SOL into BTC, moving funds through a multi-chain path that ends on THORChain.
Blockchain monitoring cited by wublockchain.xyz shows the laundering process following a consistent pattern: the illicit SOL was first spread across multiple wallets and sold for USDC, which was then bridged to Ethereum and used to purchase ETH. That ETH is now being swapped into BTC via THORChain, according to the same report.
The multi-step route — SOL to USDC, USDC bridged to Ethereum for ETH, then ETH swapped to BTC on THORChain — suggests an effort to break the on-chain trail linking the stolen assets back to their origin while settling into an asset, BTC, that is more liquid and harder to freeze than tokens native to a single chain.
The use of THORChain as a swap venue echoes a laundering technique that has drawn scrutiny in other major exploit cases, where decentralized cross-chain protocols are used specifically because they allow conversion between assets without centralized intermediaries that could halt the transfers.
It remains unclear how much of the original $6.3 billion has already been converted into BTC through this method, where the resulting BTC is ultimately being moved to, and whether any exchanges or protocols involved in the chain have taken steps to flag or freeze the implicated wallets. The report attributes the tracking to Lookonchain, and further confirmation from additional on-chain analysts has not yet been detailed.