Solana

THORChain

Bitcoin

<div>
 <h3 id="summary">Summary</h3>
 <div>
  <div>
   <div>
    <ul>
     <li>Binance hacker converts stolen Solana into Bitcoin through multiple blockchain networks, using decentralized exchanges and intermediary wallets to transfer assets.</li>
     <li>Lookonchain identified attempts to convert approximately 970,522 SOL worth $95.9 million, with THORChain and Relay Protocol facilitating cryptocurrency transfers.</li>
     <li>Binance has frozen or intercepted $2.85 billion in stolen assets, while the FBI links the $6.34 billion attack to TraderTraitor.</li>
    </ul>
   </div>
  </div>
 </div>
</div>
<p>The hacker responsible for Binance’s $6.34 billion security breach is increasing Bitcoin purchases through transactions involving stolen Solana assets. The latest activity spans multiple blockchain networks, creating additional challenges for investigators trying to recover the stolen cryptocurrency.</p>
<p><a href="https://x.com/lookonchain/status/2117813296816664730" rel="noopener noreferrer nofollow">According to&nbsp; Lookonchain</a>, the attacker executed additional Bitcoin purchases on November 4 through several decentralized cryptocurrency services. The transactions involved converting stolen Solana (SOL) into Bitcoin (BTC) across multiple blockchain networks, as Binance works with federal authorities and investigators to recover billions lost during October’s attack.</p>
<div class="embed-x">
 <blockquote class="twitter-tweet">
  <p>The Binance hacker continues to swap <a href="https://x.com/search?q=%24SOL&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SOL</a> for <a href="https://x.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a>!</p>
  <p>They're splitting the <a href="https://x.com/search?q=%24SOL&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SOL</a> across multiple wallets and selling it for <a href="https://x.com/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$USDC</a>.</p>
  <p>Then they bridge the <a href="https://x.com/search?q=%24USDC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$USDC</a> to Ethereum and buy <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a>.</p>
  <p>Finally, they swap the <a href="https://x.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> for <a href="https://x.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a> via <a href="https://x.com/hashtag/THORChain?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#THORChain</a>.<a href="https://t.co/2qK0H97eUW" rel="noopener noreferrer nofollow">https://t.co/2qK0H97eUW</a><a href="https://t.co/LrBmaI06yi" rel="noopener noreferrer nofollow">pic.twitter.com/LrBmaI06yi</a></p>
  <p>— Lookonchain (@lookonchain) <a href="https://x.com/lookonchain/status/2117813296816664730?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 4, 2026</a></p>
 </blockquote>
</div>
<p><strong>Also Read: </strong><a href="https://36crypto.com/south-korea-ruling-party-pushes-fourth-crypto-tax-delay-as-2027-deadline-approaches/" rel="noopener noreferrer nofollow">South Korea Ruling Party Pushes Fourth Crypto Tax Delay as 2027 Deadline Approaches</a></p>
<h2 id="binance-hacker-uses-multiple-blockchain-networks-to-purchase-bitcoin">Binance Hacker Uses Multiple Blockchain Networks to Purchase Bitcoin</h2>
<p>Lookonchain’s latest findings reveal that the attacker follows a structured transaction process involving several cryptocurrency wallets and decentralized exchange platforms.</p>
<p>Initially, the hacker distributes stolen SOL across different wallets before converting the tokens into USD Coin (USDC) through decentralized exchanges. The attacker subsequently transfers the stablecoins from Solana to Ethereum, creating additional transaction records across separate blockchain networks.</p>
<p>Once the assets reach Ethereum, the hacker exchanges USDC for Ether (ETH) before converting the funds into Bitcoin through THORChain. This decentralized liquidity protocol allows users to exchange cryptocurrencies across different blockchain networks without relying on centralized trading platforms.</p>
<p>Additionally, the attacker uses several intermediary wallets throughout these transactions, making it more difficult for investigators to follow the stolen assets. Blockchain analysts must therefore examine transfers across multiple networks while identifying connections between wallets involved in the cryptocurrency conversions.</p>
<h2 id="hacker-previously-targeted-nearly-96-million-in-stolen-solana">Hacker Previously Targeted Nearly $96 Million in Stolen Solana</h2>
<p>The November 4 transactions follow earlier attempts to convert substantial amounts of stolen Solana into Bitcoin through decentralized cryptocurrency services, as documented by Lookonchain. According to Lookonchain’s November 1 findings, the attacker attempted to exchange approximately 970,522 SOL worth $95.9 million, including transactions involving 486,970 SOL valued at $46.4 million within a single hour.</p>
<p>During those earlier transfers, the hacker used Relay Protocol to move cryptocurrency between different blockchain networks, while the latest transactions involve THORChain. Despite switching between decentralized platforms and transaction routes, Bitcoin remains the primary destination asset identified in Lookonchain’s blockchain analysis.</p>
<h2 id="binance-recovers-billions-as-fbi-investigates-north-korean-hackers">Binance Recovers Billions as FBI Investigates North Korean Hackers</h2>
<p>Binance has reported significant progress in recovering cryptocurrency stolen during October’s $6.34 billion security breach, with billions already frozen or intercepted.</p>
<p>According to the exchange’s November 3 update, investigators and recovery partners had frozen or intercepted approximately $2.85 billion through coordinated efforts involving Binance, blockchain intelligence companies, cryptocurrency service providers, and law enforcement authorities.</p>
<p>Meanwhile, the Federal Bureau of Investigation has <a href="https://36crypto.com/north-korea-denies-fbi-claims-linking-its-hackers-to-6-billion-binance-attack/" rel="noopener noreferrer nofollow">attributed the attack to TraderTraitor</a>, a North Korean state-sponsored hacking group, while urging decentralized cryptocurrency services, including THORChain, to block transactions involving stolen assets.</p>
<p>These measures aim to restrict the movement of stolen funds and identify additional wallets connected to the attack, although Lookonchain’s November 4 findings indicate that the attacker remains active across multiple blockchain networks.</p>
<h2 id="conclusion">Conclusion</h2>
<p>The Binance hacker’s latest Bitcoin purchases highlight the challenges facing investigators despite the exchange’s substantial cryptocurrency recovery efforts. With $2.85 billion already frozen or intercepted, authorities are tracking additional transfers involving stolen Solana and decentralized exchange platforms.</p>
<p><strong>Also Read: </strong><a href="https://36crypto.com/ethereum-exchange-supply-drops-as-297000-eth-exits-top-wallets-after-binance-hack/" rel="noopener noreferrer nofollow">Ethereum Exchange Supply Drops as 297,000 ETH Exits Top Wallets After Binance Hack</a></p>
<p>The post <a rel="noopener noreferrer nofollow" href="https://36crypto.com/binance-hacker-intensifies-bitcoin-buying-as-6-34b-recovery-efforts-face-challenges/">Binance Hacker Intensifies Bitcoin Buying as $6.34B Recovery Efforts Face Challenges</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://36crypto.com">36Crypto</a>.</p>

Binance Hacker Intensifies Bitcoin Buying as $6.34B Recovery Efforts Face Challenges

Table of Contents

36crypto

Other articles published on Nov 4, 2026

Join our free newsletter for daily crypto updates!