Solana (SOL): Binance Hackers Move 81% of Stolen SOL via THORChain

By Nodora News · 4 November 2026

Binance hackers have moved about 81% of the 970,522 Solana (SOL) stolen in the $6.3B hack, swapping it into Bitcoin through USDC, Ethereum and THORChain.

The attackers behind last week's record $6.3 billion Binance hack have now moved roughly 81% of the Solana (SOL) they stole, according to on-chain data reported on Wednesday, November 4. Of the 970,522 SOL taken in the breach, wallets tagged to the hacker by blockchain analytics platform Arkham still hold about 182,443 SOL, worth around $16.9 million. The rest has been split up and pushed through a chain of swaps that ends in Bitcoin (BTC), with the cross-chain protocol THORChain doing the final step.

Key takeaways

• About 81% of the 970,522 stolen SOL has left the hacker's wallets; roughly 182,443 SOL (about 18.8%) remains, per Arkham.
• On-chain tracker Lookonchain says the route runs SOL to USDC, then a bridge to Ethereum, then ETH, then BTC via THORChain.
• THORChain restarted swaps on most of its networks this week after a halt that, according to Chainalysis, had slowed the laundering.
• Binance says it has replenished 98% of affected assets and will absorb the losses, so customers are not footing the bill.

What happened to the stolen Solana

Binance was drained on Thursday, October 29, in what the exchange now describes as a months-long intrusion that started with a fake job interview and malware on employee machines. Solana was only one slice of the loot, but it is the slice investigators have been watching most closely this week because it has been moving fast.

On Wednesday, Lookonchain reported that the attacker was still converting SOL into Bitcoin. The process works in several hops:

• The SOL is split across many fresh wallets so no single address holds a large balance.
• Each wallet sells its SOL for USDC, a dollar stablecoin, on Solana.
• The USDC is bridged from Solana over to Ethereum.
• On Ethereum, the USDC is swapped for Ether (ETH).
• Finally, the ETH is swapped for native Bitcoin through THORChain.

Each hop moves the funds onto a different blockchain, which means investigators have to stitch together records from several networks to keep following the money. Ending in native Bitcoin, rather than a token that a company can freeze, also makes the funds much harder to claw back.

The numbers behind the laundering

Here is how the stolen SOL position looks based on the figures reported so far:

• Total SOL stolen: 970,522 SOL (close to $96 million at the time of the hack)
• Still in hacker-tagged wallets: about 182,443 SOL, around $16.9 million (Arkham)
• Moved out: roughly 788,000 SOL, or about 81% of the total
• Earlier this week: about 486,970 SOL, worth roughly $46.4 million, left the main attacker wallet in a single hour on November 1, when the hacker was using Relay Protocol rather than THORChain (Lookonchain)

The pace has picked up quickly. As recently as November 3, blockchain data firm Bitquery estimated that about 84% of the stolen SOL was still sitting in the original attacker wallet or in addresses it had directly funded, with only around 41,000 SOL converted into USDC through side wallets. One day later, Arkham's tally suggests that ratio has almost flipped.

Solana is not the only chain involved. Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated, and Chainalysis estimated that around $500 million in value has moved through Tron, including repeated transfers between wallets to muddy the trail.

Why THORChain keeps coming up

THORChain is a decentralized protocol that lets people swap native coins across blockchains, for example ETH on Ethereum for real BTC on Bitcoin, without a central exchange in the middle. That makes it useful for ordinary users, and attractive to thieves who want to avoid exchanges that can freeze accounts. North Korea-linked groups have been suspected of using it before, including after the $1.4 billion Bybit hack in 2025.

THORChain paused swaps over the weekend after an Ethereum block reorganization exposed a refund bug. Chainalysis said that pause unintentionally delayed the Binance hackers' laundering. The protocol switched trading back on for Bitcoin, Ethereum and several other networks this week, and the attacker's ETH-to-BTC flow resumed with it. We covered the restart in detail in THORChain (RUNE) Restarts Swaps on 10 Chains, Token Jumps 13%.

The FBI attributed the Binance attack to North Korea's TraderTraitor hacking group on Saturday and urged crypto services, including THORChain node operators, to block transactions tied to the stolen funds. North Korea, through a statement from Kim Yo Jong, rejected the accusation. For the full story of how the attackers got in, see Binance (BNB) $6.3B Hack Began With a Fake Job Interview, Report Says.

Solana (SOL) price and market reaction

The movement of stolen coins has not shaken the wider market today. Crypto prices are firmer after a dip earlier in the session tied to the US midterm results. OKX spot prices at the time of writing:

• Solana (SOL): about $93.96, up 1.5% in 24 hours (24h range $89.88 to $94.17)
• Bitcoin (BTC): about $78,650, up 1.9% (24h low near $75,730)
• Ether (ETH): about $2,335, up 2.9%

The SOL being sold is spread out over many small trades rather than dumped in one go, which helps explain why it has not left an obvious mark on the price. The amounts involved are also small next to Solana's daily trading volume. You can follow SOL and other majors on the Nodora charts page.

What to watch next

• The last 18.8%: whether the remaining 182,443 SOL follows the same route, and how quickly.
• THORChain's response: whether node operators act on the FBI's request to block transactions linked to the hack, and when the protocol's Solana, BNB Chain and Cosmos routes reopen.
• Freezes and recoveries: Binance says it has frozen or intercepted about $2.85 billion of the stolen assets. Bitquery estimated on November 3 that roughly $3 billion was still under the attackers' control. Any new freezes by stablecoin issuers or exchanges would shrink that figure.
• Binance's own updates: the exchange says it has rebuilt the affected systems and replenished 98% of affected assets, so further recovery reports are likely.

For SOL holders, the practical picture is unchanged: Binance customers have been made whole by the exchange, and the laundering itself does not affect the Solana network. The story to follow is how much of the stolen money investigators can still stop before it settles as Bitcoin.

#Solana #Binance Hack #THORChain #Bitcoin #Security

This article is general information, not financial advice.