Lookonchain reported that wallets linked to a Binance-related breach were still moving Solana (SOL) toward Bitcoin (BTC), with activity seen on Nov. 4. The available details do not identify the year or the specific breach, leaving the timing and its connection to Binance’s reported recovery figures unclear.
- Lookonchain said SOL was swapped through USDC and ETH before being converted to BTC via THORChain.
- An earlier report cited about 970, 522 SOL, worth roughly $95.9 million. The amount of BTC ultimately acquired is unknown.
- Binance said it had frozen or intercepted about $2.85 billion by Nov. 3.
- The reported $6.34 billion in affected assets is not clearly defined.
Reported route moves funds across networks
Lookonchain said the funds involved in the Nov. 4 activity were split among wallets, swapped from SOL into USDC, transferred from Solana to Ethereum, then used to buy ETH. The ETH was reportedly exchanged for BTC through THORChain, a decentralized protocol that enables swaps between blockchain networks.
Cross-chain transfers move assets or value between blockchains. They can complicate investigations because analysts have to connect activity across networks, wallets and services. But that complexity does not make transactions invisible. Blockchain activity can leave public records, even if tracing a route takes time and expertise.
The earlier activity, reported on Nov. 1, involved a different service. Lookonchain said about 970, 522 SOL was being converted toward Bitcoin. The SOL was worth roughly $95.9 million at the time. It also reported that 486, 970 SOL, worth about $46.4 million, was transacted in one hour. The available details do not say whether that one-hour amount was part of the 970, 522 SOL total or how much BTC was ultimately received.
That earlier route reportedly used Relay Protocol for cross-chain transfers. The later route involved THORChain. These accounts are based on Lookonchain’s tracking. The details provided do not independently verify every transaction or confirm that all of the SOL became BTC.
Recovery figures need context
Binance reportedly said about $6.34 billion in crypto assets was “affected” by a security breach. It also said it had frozen or intercepted approximately $2.85 billion by Nov. 3. Binance is the source of both figures, but the available information does not define what “affected” means or break down how much was frozen versus intercepted.
That distinction matters. Assets exposed to a breach, assets stolen and assets later secured may not be the same pool. Without a clear breakdown, and confirmation that the figures refer to the same incident, the totals cannot show how much remains with an attacker.
U.S. federal authorities reportedly attributed the attack to TraderTraitor, which they described as a North Korean state-sponsored hacking group. The FBI was also reported to have asked decentralized crypto services, including THORChain, to stop funds linked to the attack from moving. The date and details of that request are not provided, and it is unclear whether it was a formal order. Any response from THORChain, Relay Protocol or other services is also unconfirmed.
Key questions
-
Is the attacker reportedly converting SOL toward Bitcoin?
Yes. Lookonchain described continued activity on Nov. 4, but the year is unspecified and no final BTC total is available.
-
How were the funds reportedly moved?
The later route involved swapping SOL for USDC, transferring the USDC to Ethereum, buying ETH and exchanging it for BTC through THORChain. Earlier activity reportedly used Relay Protocol.
-
How much did Binance say it had secured?
Binance reportedly said it had frozen or intercepted about $2.85 billion by Nov. 3. The available information does not break down those categories.
-
What do the reported figures leave unclear?
The year of the November dates, what the $6.34 billion “affected” total covers and how much BTC was acquired are all unspecified. The available details also do not establish that Binance itself was the victim of the breach being discussed.
The reported transfers show how stolen assets can move across multiple networks, but they do not prove the funds are untraceable or establish how much Bitcoin was acquired. Until the breach, timeline and figures are clearly tied to the same incident, the headline numbers call for caution.
