Binance Hackers Push 81% of Stolen Solana Through THORChain
Attackers behind the Binance hack have moved roughly 81% of the stolen Solana (SOL) and are routing the proceeds through cross-chain protocol THORChain, according to a follow-up report on the incident. The transfers accelerated after THORChain resumed swap functionality, giving the hackers a live bridge between chains.
The development marks a new phase in the laundering operation, which had been constrained while the cross-chain venue was offline. THORChain’s native token RUNE now sits at the center of the on-chain trail, because every swap through the protocol leaves a traceable path that investigators and exchanges can monitor.
Why THORChain Became the Preferred Exit Rail
THORChain lets users swap native assets across chains without wrapping tokens or relying on centralized intermediaries. For an attacker holding a large SOL position, that means the stolen coins can be converted into Bitcoin or other assets without first passing through a KYC-gated exchange.
The protocol’s resumption of swaps was the trigger. While THORChain was paused, the attackers could only park the SOL or move it into less liquid venues. Once swaps came back online, the remaining balance became convertible again, and 81% of the haul has now been pushed through that rail.
The mechanism matters because THORChain liquidity is finite. Large swaps move pool prices, and the resulting slippage is visible on-chain. That creates a measurable footprint for analytics firms tracking the flow.
SOL Holds Near $92.71 Despite the Laundering Headline
Solana traded at $92.71 on Nov. 3, up 0.96% on the day, based on the latest available market data. The price action suggests the market is treating the laundering activity as an isolated security incident rather than a systemic threat to the Solana network.
That resilience is notable. A large stolen supply being liquidated is typically a bearish overhang, yet SOL has held its ground. One explanation is that the stolen coins are being swapped out of SOL into other assets through THORChain, which spreads selling pressure across venues rather than concentrating it on centralized SOL order books.
RUNE is the more directly exposed asset. Each swap through THORChain generates fees and liquidity demand for the protocol’s pools, but it also invites scrutiny from exchanges and regulators who track illicit flows.
The Compliance Clock Ticking on Cross-Chain Swaps
THORChain is decentralized, but its liquidity providers and front-end operators are not anonymous to the same degree. Chain-analytics firms can flag addresses tied to the Binance hack, and centralized exchanges can freeze deposits that trace back to those wallets.
The remaining 19% of the stolen SOL is the key variable. If the attackers attempt to move it through the same THORChain route, the on-chain signature will be familiar to investigators. If they pivot to a new method, the trail becomes harder to follow.
For Solana holders, the immediate risk is sentiment rather than supply. The network itself was not compromised in this incident; the theft targeted Binance’s custody of user assets. Still, repeated headlines about stolen SOL can weigh on retail confidence.
What to Watch: The Final 19% and the $92.71 Line
The next signal is whether the remaining 19% of the stolen SOL moves through THORChain or a different venue. A second wave of swaps would confirm the route is still open and functional for the attackers.
On the price side, $92.71 is the level to hold. A break below it would suggest the market is starting to price in the overhang; a sustained move above it would indicate the laundering story is being absorbed without lasting damage.
Watch THORChain swap volumes and any exchange announcements about frozen deposits tied to the Binance hack. Those two data points will confirm whether the 81% figure is the peak of the laundering operation or just the first visible tranche.
Sources: cointelegraph.com