Wallets Tied to Binance Exploit Move 81% of Stolen Solana as Swaps Resume

Wallets linked to the Binance exploit have moved roughly 81% of the stolen Solana (SOL) out of tracked holdings as cross-chain swaps resumed on THORChain Wednesday.

The identified wallets held 182,443 SOL, valued at $16.9 million, equal to 18.8% of the 970,522 SOL stolen in the exploit. That balance means about 81% of the stolen SOL is no longer in those wallets.

The transaction path split SOL across multiple wallets, converted it to USD Coin (USDC), then bridged it to Ethereum to buy Ether (ETH). The ETH was swapped for Bitcoin (BTC) through THORChain, a protocol that enables exchanges across blockchain networks.

THORChain restored swaps on Bitcoin, Ethereum and several other networks Wednesday after pausing service Saturday. An Ethereum block reorganization exposed a refund bug, and the pause delayed movement of Binance-linked funds.

Binance said employees’ devices were compromised through fake job interviews and malicious software downloads. The attackers expanded activity to Solana Sunday after emptying most of their temporary Tron wallets.