The Binance hacker, now being relentlessly tracked around the world, is frantically splitting up the funds—moving SOL through cross-chain swaps and mixers, step by step converting it into BTC to make a getaway!
With the entire internet on the hunt, the hacker’s money laundering has mainly followed two routes.
The first is a cross-chain swap route. Lookonchain detected the hacker splitting SOL across multiple wallets, converting it to USDC, bridging it to Ethereum to buy ETH, and ultimately swapping it for BTC through THORChain.
The second route goes through a mixer. Onchain Lens detected the hacker depositing 8,567 SOL (about $800,000) into the Solana mixer Privacy Cash to launder the funds.
In its security report on November 3, Binance officially disclosed that on October 20, the hacker used compromised employee computers and internal AI tools to take control of two engineers responsible for wallet infrastructure. Cosine of SlowMist said the theft was part of an extremely sophisticated APT attack—not a case of basic negligence by the engineers.
All this activity, while the entire internet is closing in, will only expose more clues. Just trace the destination addresses of the BTC swapped out through THORChain. No matter how many times the funds are split up, they won’t be able to cash out.
With the entire internet on the hunt, the hacker’s money laundering has mainly followed two routes.
The first is a cross-chain swap route. Lookonchain detected the hacker splitting SOL across multiple wallets, converting it to USDC, bridging it to Ethereum to buy ETH, and ultimately swapping it for BTC through THORChain.
The second route goes through a mixer. Onchain Lens detected the hacker depositing 8,567 SOL (about $800,000) into the Solana mixer Privacy Cash to launder the funds.
In its security report on November 3, Binance officially disclosed that on October 20, the hacker used compromised employee computers and internal AI tools to take control of two engineers responsible for wallet infrastructure. Cosine of SlowMist said the theft was part of an extremely sophisticated APT attack—not a case of basic negligence by the engineers.
All this activity, while the entire internet is closing in, will only expose more clues. Just trace the destination addresses of the BTC swapped out through THORChain. No matter how many times the funds are split up, they won’t be able to cash out.
