Binance Hacker Converts $95.9M Stolen Solana to Bitcoin via THORChain North Korean threat group TraderTraitor converts stolen Binance funds into Bitcoin using complex THORChain transactions to evade FBI freezes. The hacker responsible for the massive $6.34 billion security breach at Binance continues aggressively accumulating Bitcoin (BTC). On November 4, blockchain analytics platform Lookonchain reported that the actor is converting stolen Solana (SOL) tokens into Bitcoin through intricate cross-chain transactions. This ongoing activity demonstrates the persistence of the threat actor despite significant law enforcement intervention and exchange countermeasures. The hacker utilizes a sophisticated multi-stage process to launder the stolen cryptocurrency. The scheme begins by splitting Solana assets across multiple distinct wallets to obscure the origin of the funds. These assets are then sold for USDC, which is subsequently transferred from the Solana network to the Ethereum network. The operator buys Ethereum using the USDC and finally exchanges the ETH for Bitcoin using THORChain. This long and complicated cross-chain transaction process allows the hacker to easily transfer funds between different blockchain networks while making it significantly harder for analysts to trace the stolen assets.Official updates from Binance indicate that the massive security breach has affected crypto assets worth approximately $6.34 billion. As of November 3, the exchange confirmed it has frozen or intercepted about $2.85 billion worth of the stolen cryptocurrency. US federal authorities have identified the attack as being conducted by a North Korean state-sponsored hacker group known as TraderTraitor. The FBI is actively asking various decentralized crypto services, including THORChain, to prevent funds linked from moving around, yet on-chain data shows the group continues to move funds.This is not the first time the Binance hacker has attempted to convert stolen holdings into Bitcoin. On November 1, Lookonchain data revealed the actor was trying to convert approximately 970,522 SOL tokens. At the time of that report, those tokens were worth roughly $95.9 million. During those earlier transactions, the hacker used a different service called Relay Protocol to facilitate cross-chain crypto transfers. The latest blockchain data suggests the hacker remains focused on Bitcoin accumulation and continues to utilize several decentralized services to exchange the stolen crypto for the leading digital asset.Despite the interception of billions of dollars, the threat actor has demonstrated a high capacity for adapting to countermeasures. The use of decentralized protocols like THORChain and Relay Protocol highlights the challenges regulators face in tracing funds moving through non-custodial liquidity pools. The continued accumulation of Bitcoin indicates that the hacker has sufficient access to large volumes of the stolen Solana supply.This persistent activity underscores the ongoing risk posed by state-sponsored cybercriminal groups and their ability to exploit the interconnected nature of modern decentralized finance ecosystems. The complexity of these cross-chain swaps makes it increasingly difficult for traditional compliance tools to flag suspicious activity in real-time. Law enforcement agencies are now facing an uphill battle against anonymized digital asset flows.The incident serves as a stark reminder of the vulnerabilities within the broader cryptocurrency infrastructure. While centralized exchanges like Binance implement robust security measures, decentralized bridges and liquidity providers remain attractive targets for money laundering operations. The ability to seamlessly move value across disparate blockchains without intermediaries complicates regulatory oversight significantly.Authorities continue to monitor the wallet addresses associated with the TraderTraitor group closely. However, the rapid evolution of mixing techniques and the proliferation of new cross-chain tools suggest that the hacker may find additional avenues to liquidate remaining assets. The global financial community must remain vigilant as these tactics become more refined and widespread.