Binance Hacker Moves Stolen SOL to BTC via THORChain: Lookonchain

On-chain intelligence platform Lookonchain has flagged a reported attempt by the wallet linked to the $6.3 billion Binance hack to convert stolen Solana (SOL) holdings into Bitcoin (BTC) using THORChain as the cross-chain routing layer, adding a new dimension to one of crypto’s most closely watched theft cases.

Lookonchain Flags a Shift From Stolen SOL to BTC

According to Lookonchain, the wallet attributed to the Binance hacker executed a swap route that moved allegedly stolen SOL into BTC. The claim, credited solely to Lookonchain’s on-chain monitoring, characterizes the movement as a laundering attempt rather than a routine portfolio rebalancing. No independent blockchain forensics firm has publicly corroborated the specific wallet attribution at the time of writing. For related coverage, see Kim Jong Un Memes Flood X After Binance’s $6.3B Hack.

This is not the first time the alleged hacker’s wallet has drawn attention for asset conversion activity. An earlier reported swap saw the wallet move $46.4 million in stolen SOL into Bitcoin, suggesting a deliberate, staged strategy to shift exposure away from SOL and into BTC across multiple transactions. The pattern, if confirmed, points to an actor who is methodical rather than reactive.

The $6.3 billion figure attached to the Binance hack has reverberated across the broader market since the event. The scale of the alleged theft even prompted Binance co-founder CZ to publicly praise U.S. authorities in the aftermath, signaling that exchange-level cooperation with investigators was underway. That context matters when assessing how much scrutiny on-chain movements from the implicated wallets are receiving.

Why THORChain Is Central to the Reported Swap Route

THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps between different blockchain ecosystems without requiring wrapped tokens or centralized intermediaries. By routing through THORChain, the reported swap moved value directly from the Solana network to the Bitcoin network, crossing an asset boundary that most on-chain monitoring tools find harder to track in real time.

The choice of THORChain is operationally significant. Converting SOL to BTC through a centralized exchange would require KYC verification and could trigger automatic compliance flags. A decentralized cross-chain protocol like THORChain bypasses those checkpoints, though the transactions remain visible on-chain at both the originating Solana address and the receiving Bitcoin address. Lookonchain’s report demonstrates that cross-chain activity is not invisible, only harder to stitch together without specialized tooling.

It is important to separate a reported transaction route from a definitive conclusion about the funds’ ultimate control. On-chain analysis can establish that assets moved from wallet A to wallet B through protocol C, but proving real-world custody, intent, or identity requires additional investigative steps beyond what public blockchain data alone can confirm.

What the Report Could Mean for On-Chain Monitoring

The Lookonchain report underscores a tension that has defined post-hack forensics in crypto: on-chain data is transparent, but attribution is probabilistic. Blockchain transaction analysis can follow the money across chains, yet the gap between “this wallet moved these funds” and “this person controls this wallet” remains a legal and investigative challenge. Reports like this one should be independently corroborated before forming the basis of enforcement action or firm conclusions.

The ripple effects of the $6.3 billion hack extended beyond the directly affected assets. Following the event, XRP added nearly 8,000 new wallets in a surge that analysts tied to the broader market dislocation caused by the hack. Meanwhile, bullish analysts attempting to frame the hack’s aftermath positively faced pushback from stablecoin data that complicated the narrative. The hack’s downstream effects have been wide and varied.

For exchanges and compliance teams, the reported THORChain routing is a signal that cross-chain bridges and decentralized swap layers warrant the same monitoring attention as centralized trading venues. If a wallet flagged in connection with a $6.3 billion theft can route funds across chains in a way that takes specialized tooling to detect, the case for broader cross-chain transaction monitoring becomes harder to dismiss.

Additional source references: source document 1, source document 2.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.