Binance attackers move 81% of stolen Solana, route funds through THORChain

Attackers linked to the Binance theft moved 81% of the stolen Solana, or SOL, and continued routing funds through THORChain after the protocol resumed swaps, Cointelegraph reported. The update describes movement of most of the stolen SOL, rather than a confirmed recovery of the assets or an identification of those responsible.

The reported percentage concerns the stolen SOL specifically, not necessarily the full value of any assets involved in the theft. The supplied account does not give a token count, a dollar valuation or a transaction-by-transaction breakdown, limiting what can be established about the size and timing of the transfers.

Cointelegraph described the continued routing of funds through THORChain as laundering. That characterization concerns the attackers’ handling of the proceeds; the supplied material does not allege that THORChain itself carried out the theft or establish that its operators knowingly assisted the attackers in moving the stolen assets.

The resumption of swaps is a central part of the reported sequence because the attackers continued using the protocol afterward. However, the available account does not explain why swaps had stopped, how long the interruption lasted or whether the earlier suspension was connected to this particular theft or its aftermath.

Moving stolen cryptocurrency and recovering it are separate developments, and the reported transfers do not establish that the funds are beyond reach. Equally, the visibility of asset movements does not by itself demonstrate that an exchange, investigator or other party can freeze, retrieve or return the assets to their owners.

The distinction also matters when interpreting the 81% figure: it measures the share of stolen SOL reported as moved, not a confirmed share successfully converted into cash. The supplied report does not establish the funds’ final destination, identify a cash-out service or say how much value remained under the attackers’ control afterward.

For those following the theft, the immediate significance is that most of the stolen SOL was no longer stationary in the holdings being tracked. Further transfers or swaps could change where investigators need to look, but the supplied account offers no official assessment of how the latest movements affect prospects for recovery.

The next substantive update would need to clarify where the assets went, whether additional transfers occurred and whether any funds were intercepted or returned. For now, Cointelegraph’s account supports a narrower conclusion: the attackers moved most of the stolen SOL and continued using THORChain after swaps resumed, while the ultimate disposition of the proceeds remains unestablished in the supplied material.