Attackers behind the $6.3 billion Binance exploit moved 81% of stolen Solana holdings, directing transactions through THORChain cross-chain pools following the resumption of swaps across the network.
The Binance hacker continues to swap $SOL for $BTC!
They're splitting the $SOL across multiple wallets and selling it for $USDC.
Then they bridge the $USDC to Ethereum and buy $ETH.
Finally, they swap the $ETH for $BTC via #THORChain.https://t.co/2qK0H97eUW pic.twitter.com/LrBmaI06yi
— Lookonchain (@lookonchain) November 4, 2026
On-chain forensic activity revealed immediate capital rotation into alternative networks. According to analytics service Lookonchain on social media, the exploiter converted an initial batch of 486,970 SOL tokens valued at $46.4 million toward Bitcoin via intermediate routing services.
The rapid multi-chain transfer expanded across eleven networks after October 29, 2026. The immediate disruption pushed institutional liquidity providers to rebalance their positions as Binance capital flight pressure emerged across international trading desks.
Forensic data compiled by the Arkham Intelligence entity profile shows that associated hacker wallets maintain 182,443 remaining SOL tokens, representing approximately $16.9 million in unconverted balances.
Law enforcement agencies escalated operational tracking across decentralized protocols. A public FBI cyber threat alert formally attributed the intrusion to North Korean state-sponsored group TraderTraitor, urging protocol validators and swap providers to halt incoming tainted transactions.
Stablecoin issuers Tether and Circle froze roughly $2.7 billion in unauthorized tokens minutes after the breach, though attackers retained over $2.4 billion across unfreezable digital assets including Bitcoin and native coins.
Market conditions stabilized once the exchange reopened platform services. Platform metrics registered positive net exchange inflows as user redemptions slowed following the commitment of company balance-sheet reserves to offset customer balances.
On-chain investigators and exchange compliance teams continue to track the destination of converted Bitcoin outputs across remaining target addresses.
This article is for informational purposes only and does not constitute financial advice.
