The hacker behind the $6.3 billion Binance breach is converting stolen Solana tokens into Bitcoin through THORChain after cross-chain bridge Relay Protocol blocked addresses linked to the theft. Tracked by Lookonchain, the attacker is splitting a stolen 970,522 SOL position initially valued at $95.9 million across multiple wallets, selling the tokens for USDC, bridging the stablecoin to Ethereum to buy ETH, and swapping that ETH into BTC via THORChain.
Onchain analyst SomaXBT found that 54% of the attacker’s 47,644 transactions across Tron and Solana were automated, after the launderers moved more than $500 million out of Tron staging wallets and onto Solana. The rapid conversions have strained decentralized finance liquidity pools, with Opsek founder Pablo Sabbatella noting that the hackers “had to swap so much that in some swaps, they lost up to 10%,” while MEV searchers and block builders captured roughly $50 million from the trades. In one transaction on Uniswap V2, the attacker sold 908,793 PROM worth about $5 million into a nearly empty pool and received $71 in ETH.