The Binance hacker is using THORChain to convert stolen SOL into BTC, WuBlockchain reported on November 4, 2026, citing Lookonchain. Its post, published at 03:57 UTC, describes a change in the route used to move the stolen assets.
The update concerns proceeds from the Binance theft, not a new breach at THORChain. The protocol appears in the report as the service used to exchange those assets. The activity described takes place after the theft, as the hacker moves the proceeds between assets and blockchains.
The Reported Route Changes Both Asset and Blockchain
WuBlockchain describes the activity as laundering stolen SOL into BTC. The reported exchange moves value between networks and changes the asset in which the proceeds are held. A transfer between wallets holding SOL would leave the funds in the same token; this route ends with bitcoin.
For investigators, tracing that conversion requires connecting the incoming SOL with the outgoing bitcoin. Following only subsequent SOL transfers would capture a narrower part of the movement, leaving the destination side of the reported swap outside that search. The relevant trail therefore spans the source funds, the exchange and the destination.
WuBlockchain is relaying Lookonchain's finding; this article has not independently reconstructed the transactions. The cited finding concerns a laundering route, with no recovery or completed cash-out reported in the update.
THORChain Connects Native Assets Through RUNE
THORChain's official documentation explains how such a conversion works. The protocol supports both Solana and Bitcoin and allows users to exchange native assets across blockchains without relying on wrapped tokens.
Its liquidity pools pair supported assets with RUNE. A swap between two other assets routes through that intermediary: the incoming asset is exchanged for RUNE, which is then exchanged for the destination asset. Users do not need to hold RUNE themselves. For a SOL-to-BTC swap, that means RUNE sits between the asset entering the route and the asset delivered at the end.
THORChain also says its protocol requires no account, registration, or identity verification, although third-party interfaces can impose their own requirements. Its transactions take place onchain.
Permissionless access still leaves an observable transaction record. Investigators can examine that record for connections between the reported source funds, the swap and its destination. The absence of an account requirement concerns access to the protocol; tracing funds depends on following the transactions across the conversion.
Overview
WuBlockchain, citing Lookonchain, reports that the Binance hacker is converting stolen SOL into BTC through THORChain. The update describes the movement of theft proceeds through a protocol that supports native cross-chain swaps using RUNE as an intermediary.
