Solana faces Binance hacker’s $95.9M swap – Can SOL defend $90?

THORChain is a cross-chain liquidity protocol that lets attackers swap stolen assets without a centralized exchange's KYC checks, a route North Korea-linked hackers used after the 2022 Ronin and 2023 Atomic Wallet breaches. Binance has not disclosed the scale of this theft, but blockchain trackers identified the stolen Solana early and began following its path. The protocol had paused swaps before resuming them, and the attackers waited for that reopening to keep laundering funds through it.

With 81% of the stolen SOL already split, sold for USDC, bridged to Ethereum and converted into Bitcoin, Solana holders face a concentrated seller that has already cleared most of its position. The remaining 182,443 SOL, worth $16.9 million, sits in wallets Arkham has flagged, giving exchanges and chain analysts a known target to freeze or blacklist before it moves. Traders tracking on-chain flows gain an early warning signal; the attackers lose the element of surprise for whatever is left to launder.

A $23 million short against SOL alongside a weakening SOL/BTC pair raises the question of whether this laundering operation is itself moving the market or simply riding a trend already in motion. THORChain's willingness to process these swaps despite its past role in similar hacks tests how far a 'decentralized' protocol can disclaim responsibility for what it routes. The tension is real: permissionless swaps are the feature, not a bug, but that same design makes the protocol a laundering rail of choice.

Whether SOL holds its $90 level will show if the market has already priced in the hacker's remaining exposure or if further swaps still to come push it lower. The 182,443 SOL left in flagged wallets is the figure to track: a sale through THORChain would complete the laundering cycle, while a freeze or seizure by exchanges would mark a rare interruption in the attackers' playbook.