Binance Hacker Intensifies Bitcoin Buying as $6.34B Recovery Efforts Face Challenges

The hacker responsible for Binance’s $6.34 billion security breach is increasing Bitcoin purchases through transactions involving stolen Solana assets. The latest activity spans multiple blockchain networks, creating additional challenges for investigators trying to recover the stolen cryptocurrency.

According to  Lookonchain, the attacker executed additional Bitcoin purchases on November 4 through several decentralized cryptocurrency services. The transactions involved converting stolen Solana (SOL) into Bitcoin (BTC) across multiple blockchain networks, as Binance works with federal authorities and investigators to recover billions lost during October’s attack.

Also Read: South Korea Ruling Party Pushes Fourth Crypto Tax Delay as 2027 Deadline Approaches

Binance Hacker Uses Multiple Blockchain Networks to Purchase Bitcoin

Lookonchain’s latest findings reveal that the attacker follows a structured transaction process involving several cryptocurrency wallets and decentralized exchange platforms.

Initially, the hacker distributes stolen SOL across different wallets before converting the tokens into USD Coin (USDC) through decentralized exchanges. The attacker subsequently transfers the stablecoins from Solana to Ethereum, creating additional transaction records across separate blockchain networks.

Once the assets reach Ethereum, the hacker exchanges USDC for Ether (ETH) before converting the funds into Bitcoin through THORChain. This decentralized liquidity protocol allows users to exchange cryptocurrencies across different blockchain networks without relying on centralized trading platforms.

Additionally, the attacker uses several intermediary wallets throughout these transactions, making it more difficult for investigators to follow the stolen assets. Blockchain analysts must therefore examine transfers across multiple networks while identifying connections between wallets involved in the cryptocurrency conversions.

Hacker Previously Targeted Nearly $96 Million in Stolen Solana

The November 4 transactions follow earlier attempts to convert substantial amounts of stolen Solana into Bitcoin through decentralized cryptocurrency services, as documented by Lookonchain. According to Lookonchain’s November 1 findings, the attacker attempted to exchange approximately 970,522 SOL worth $95.9 million, including transactions involving 486,970 SOL valued at $46.4 million within a single hour.

During those earlier transfers, the hacker used Relay Protocol to move cryptocurrency between different blockchain networks, while the latest transactions involve THORChain. Despite switching between decentralized platforms and transaction routes, Bitcoin remains the primary destination asset identified in Lookonchain’s blockchain analysis.

Binance Recovers Billions as FBI Investigates North Korean Hackers

Binance has reported significant progress in recovering cryptocurrency stolen during October’s $6.34 billion security breach, with billions already frozen or intercepted.

According to the exchange’s November 3 update, investigators and recovery partners had frozen or intercepted approximately $2.85 billion through coordinated efforts involving Binance, blockchain intelligence companies, cryptocurrency service providers, and law enforcement authorities.

Meanwhile, the Federal Bureau of Investigation has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, while urging decentralized cryptocurrency services, including THORChain, to block transactions involving stolen assets.

These measures aim to restrict the movement of stolen funds and identify additional wallets connected to the attack, although Lookonchain’s November 4 findings indicate that the attacker remains active across multiple blockchain networks.

Conclusion

The Binance hacker’s latest Bitcoin purchases highlight the challenges facing investigators despite the exchange’s substantial cryptocurrency recovery efforts. With $2.85 billion already frozen or intercepted, authorities are tracking additional transfers involving stolen Solana and decentralized exchange platforms.

Also Read: Ethereum Exchange Supply Drops as 297,000 ETH Exits Top Wallets After Binance Hack