Binance hacker moves $798K in SOL into Privacy Cash mixer

What happened

An address linked to the hacker behind the Binance breach has deposited 8,567 SOL into Privacy Cash, according to the blockchain monitoring account Onchain Lens. The transfers were valued at approximately $798,000 in a Nov. 3 post, which included a screenshot showing multiple transactions involving the service.

Onchain Lens said several other addresses were displaying similar activity while it continued tracing and reconciling the funds, and a follow-up post pointed to the Solscan account associated with the activity.

The Privacy Cash deposits are the latest in a series of moves by attackers trying to obscure the origins of stolen assets. Earlier tracing by Elliptic found that about 87,000 SOL, valued at $8 million, had left the original Solana theft wallet by 08:40 UTC on Nov. 3, passing through new wallets, lending vaults and a liquid-staking service before being sold or converted into Bitcoin.

Elliptic also documented around 28 BTC moving through 18 CoinJoin transactions between Nov. 1 and early Nov. 2. Separately, Cointelegraph reported that the attackers had moved about 81% of the stolen Solana, splitting it across wallets, selling for USDC, bridging to Ethereum to buy Ether and swapping ETH for Bitcoin through THORChain.

Why it matters

The deposits illustrate how stolen funds can be spread across several laundering methods at once, from privacy-focused services on Solana to Bitcoin CoinJoin transactions and cross-chain swaps. Each route adds a layer between the original theft and any eventual cash-out, complicating recovery efforts.

Elliptic assessed that a negligible amount of the stolen assets had likely been cashed out, with roughly $3.18 billion remaining in theft-linked addresses, mostly in Ethereum and Bitcoin. That suggests much of the money is still being moved rather than spent.

The case also highlights the distinction between making customers whole and recovering stolen property. Binance's replacement of affected balances does not mean investigators have clawed back the same assets from the attackers.

What the data shows

Onchain Lens put the Privacy Cash deposits at 8,567 SOL, worth about $798,000. Elliptic's updated investigation found roughly 87,000 SOL, valued at $8 million, had left the original theft wallet by the morning of Nov. 3, and estimated that about $3.18 billion remained in theft-linked addresses.

Cointelegraph, citing Arkham, reported that wallets grouped under the Binance hacker entity held 182,443 SOL, worth $16.9 million, or about 18.8% of the 970,522 SOL stolen. Blockchain investigator SomaXBT estimated that about 54% of the attackers' more than 47,600 transactions on Tron and Solana were automated, while Chainalysis estimated about $500 million in total value moved through Tron.

Elliptic said Circle froze all 823 million stolen USDC before those tokens could be swapped, and the FBI published attacker addresses late on Oct. 31.

Background

Binance suffered the record-setting breach on Oct. 29 after attackers compromised employee devices through fake job interviews and malicious software downloads, the exchange said. According to Binance, the campaign involved fake recruitment interviews, malicious developer software and access through an internal AI tool to reach systems that authorize wallet transactions.

The FBI attributed the attack to North Korea's TraderTraitor hackers and urged crypto service providers, including THORNode operators, to block transactions linked to the stolen assets. Kim Yo Jong, sister of North Korean leader Kim Jong Un, dismissed the accusations as absurd rhetoric.

Binance co-CEO Richard Teng told CNBC on Nov. 3 that the exchange had replenished 98% of the $6.34 billion in affected assets and was still purchasing less liquid tokens. He also said Binance had completed its latest Proof of Reserves.

THORChain, a cross-chain swap protocol used in the laundering, restored trading on Bitcoin, Ethereum and several other chains on Nov. 4 after a halt on Nov. 1 caused by an Ethereum block reorganization that exposed a refund bug. Chainalysis said the pause inadvertently delayed the hackers' laundering activity.

What is still unclear

It is not clear from the reports how much of the total stolen funds has passed through Privacy Cash or whether the service can or will cooperate with investigators. The reports also do not establish how much of the assets moved through mixers or cross-chain swaps has been recovered.

The exact relationship between the addresses flagged by Onchain Lens and those tracked by Elliptic and Arkham was not detailed in the reports.

What to watch

Further tracing by Elliptic, Onchain Lens and Arkham may show whether the Privacy Cash deposits are followed by conversions or cross-chain transfers. Investigators and exchanges will also be watching whether THORChain's restored swaps accelerate laundering, and whether Binance completes the remaining purchases needed to fully replenish affected balances.

Questions readers ask