UPDATE: Binance exploiters route 81% of stolen Solana via THORChain
CIE News ·
Update to Binance drained of up to $6.43 billion in suspected Lazarus Group breach
Based on reporting by Cointelegraph; not yet independently confirmed.
Hackers behind the Binance breach have moved about 81% of stolen Solana (SOL) via THORChain, leaving under $16.9 million across tracked addresses, Cointelegraph reported.
Attackers behind the recent Binance exploit have transferred roughly 81% of the stolen Solana (SOL) through the THORChain protocol, Cointelegraph reported on November 4, 2026. As previously reported, Binance suffered an exploit draining between $6.3 billion and $6.43 billion across 11 blockchains following a software supply chain compromise.
The laundering activity reportedly continued after THORChain resumed its swap operations, leaving less than $16.9 million in tracked wallets. Investigators including the FBI, TRM Labs, Chainalysis, and Elliptic linked the multi-chain theft to North Korea's Lazarus Group, while between $2.85 billion and $3 billion in stablecoins remains frozen on-chain.
Key facts
- 81% of stolen SOL moved
- Routed via THORChain
- Under $16.9M SOL remaining
- $2.85B-$3B stablecoins frozen
Read the original at Cointelegraph