Choose Rich Live
Crypto News

Binance exploit hacker launders stolen Solana into Bitcoin via THORChain

The hacker behind the $6.3 billion Binance exploit has moved 81% of the stolen Solana, routing funds through Ethereum and THORChain to swap assets into Bitcoin.

Arkham Intelligence transaction detail showing a transfer of 120 ETH to the THORChain Router, swapped into 3.438 BTC.
Image: @WuBlockchain

The hacker responsible for the $6.3 billion Binance exploit has moved 81% of the stolen Solana, laundering the assets into Bitcoin by routing them across multiple blockchains, according to on-chain analytics firm Lookonchain.[1][2][3][4]

The laundering trail shows illicit funds first dispersed across multiple wallets, where SOL was sold for USDC. The stablecoin was then bridged to Ethereum to acquire ETH before being swapped into BTC using THORChain's cross-chain swap protocol, which attackers continued using after the network resumed swap capabilities.[1][2][3][4]

Arkham transaction records reveal wallet 0x0179B0F21D3c7F283e463Ae36EF15f9cB049277E converting USDC into ETH via Velora (formerly ParaSwap) adapters before depositing funds into the THORChain Router. In one Nov. 3, 2026 transaction, the wallet transferred 120 ETH ($274.5K) to the router, resulting in 3.438 BTC ($271.5K) being delivered to a destination Bitcoin address.[2]

Key facts

  • Attackers behind the $6.3 billion Binance-related crypto theft have moved 81% of the stolen SOL.
  • According to Lookonchain, the hacker dispersed stolen SOL across multiple wallets to sell for USDC, bridged the USDC to Ethereum for ETH, and converted ETH into BTC via THORChain.
  • The exploiters continued routing transactions through THORChain after the protocol resumed its swap functionality.
  • Arkham records show wallet 0x0179B0F21D3c7F283e463Ae36EF15f9cB049277E sent 120 ETH ($274.5K) to the THORChain Router on Nov. 3, 2026 at 23:09:11 UTC.
  • The THORChain cross-chain bridge delivered 3.438 BTC ($271.5K) to Bitcoin address bc1qpaugh9ue2vdd5046scr0jcvy2kvenvf5t66ssq.
  • Arkham data shows the same Ethereum wallet executing multiple USDC-to-ETH swaps via Velora (formerly ParaSwap) adapters ahead of THORChain transfers.

Sources · 4 sources

  1. C®

    CryptoSavingExpert ®@CryptoSavingExpPost on X ·

    The attackers behind the $6.3B Binance-related crypto theft have reportedly moved 81% of the stolen Solana. They're continuing to route funds through THORChain, taking advantage of cross-chain swaps to move assets between networks. This is a serious reminder that recovering stolen crypto is only part of the challenge. Tracking where the funds go and disrupting the laundering process is just as important. THORChain's resumption of swaps adds another layer to an already complex investigation.

    Open source
  2. WB

    Wu Blockchain@WuBlockchainPost on X ·

    Binance Hacker Pivots to THORChain to Launder Stolen SOL into BTC According to Lookonchain, the hacker behind the $6.3 billion Binance exploit is continuing to convert stolen SOL into BTC. The illicit funds were first dispersed across multiple wallets, where SOL was sold for USDC. The USDC was subsequently bridged to Ethereum to purchase ETH, which is then being swapped into BTC via THORChain.

    Open source
  3. CO

    Cointelegraph@CointelegraphPost on X ·

    🚨 TODAY: The Binance hacker continues to swap stolen SOL for BTC, per Lookonchain. The new route sells SOL for USDC, bridges it to Ethereum for ETH, then converts to BTC through THORChain. https://t.co/YjV0sASH5m

    Open source
  4. CT

    Coin TelegraphArticle ·

    Binance hackers move 81% of stolen Solana, route funds via THORChain The Binance attackers moved most of the stolen SOL and continued laundering funds through THORChain after the protocol resumed swaps.

    Open source