The attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana (SOL). They continue to launder funds through THORChain, which resumed swaps this week. The FBI attributes the attack to North Korea's TraderTraitor hackers.
The attackers behind the $6.3 billion Binance hack have moved about 81% of the stolen Solana as they launder assets through the cross-chain swap protocol THORChain.
Wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million, according to Arkham. That is roughly 18.8% of the 970,522 SOL stolen during the exploit.
How the stolen SOL moves through THORChain
Lookonchain reported on Wednesday that the attackers split SOL across multiple wallets and sold it for USDC. They then used a bridge to Ethereum to buy Ether, and finally swapped ETH for Bitcoin (BTC) via THORChain.
Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated.
THORChain restored trading on Wednesday on Bitcoin, Ethereum and several other chains. Services had stopped on Saturday after an Ethereum block reorganization exposed a refund bug. According to Chainalysis, the halt inadvertently delayed the hackers' laundering.
Binance, the FBI and North Korea respond
Binance said attackers compromised employee devices through fake job interviews and malicious software downloads. The exchange replenished 98% of affected tokens on Tuesday and said it would absorb losses.
The FBI attributed the attack to North Korea's TraderTraitor hackers on Saturday. It urged crypto service providers, including THORNode operators, to block transactions linked to stolen assets.
Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as "absurd rhetoric."
North Korea-linked groups are suspected of using THORChain to launder proceeds from some of the largest crypto hacks, including the $1.4 billion Bybit hack.
Source: Cointelegraph
Trading involves risk.
Risk Disclaimer
