On-chain intelligence platform Lookonchain has flagged a reported attempt by the wallet linked to the $6.3 billion Binance hack to convert stolen Solana (SOL) holdings into Bitcoin (BTC), using THORChain as the cross-chain routing layer. The development adds a new dimension to one of the most closely watched theft cases in the crypto industry and underscores the growing role of decentralized cross-chain infrastructure in post-hack fund movements.

Lookonchain Flags a Move From Stolen SOL Into BTC

According to Lookonchain, the wallet attributed to the Binance hacker executed a swap route that moved allegedly stolen SOL into BTC. The claim, credited solely to Lookonchain's on-chain monitoring, characterizes the movement as a laundering attempt rather than a routine portfolio rebalancing. At the time of writing, no independent blockchain forensics firm has publicly corroborated the specific wallet attribution.

This is not the first time the alleged hacker's wallet has drawn attention for asset conversion activity. An earlier reported swap saw the wallet move $46.4 million in stolen SOL into Bitcoin, a transaction that suggested a deliberate, staged strategy of shifting exposure away from SOL and into BTC across multiple transfers. If the pattern is confirmed, it points to an actor who is methodical rather than reactive.

The $6.3 billion figure attached to the Binance hack has reverberated across the broader market since the event took place. The scale of the alleged theft even prompted Binance co-founder CZ to publicly praise U.S. authorities in the aftermath, signaling that exchange-level cooperation with investigators was underway. That context matters when assessing how much scrutiny on-chain movements from the implicated wallets are now receiving.

THORChain's Role in the Reported Swap Route

THORChain is a decentralized cross-chain liquidity protocol that enables native asset swaps between different blockchain ecosystems without requiring wrapped tokens or centralized intermediaries. By routing through THORChain, the reported swap moved value directly from the Solana network to the Bitcoin network, crossing an asset boundary that most on-chain monitoring tools find harder to track in real time.

The choice of routing layer is operationally significant. Converting SOL to BTC through a centralized exchange would require KYC verification and could trigger automatic compliance flags. A decentralized cross-chain protocol such as THORChain bypasses those checkpoints, though the transactions remain visible on-chain at both the originating Solana address and the receiving Bitcoin address. In practice, the reported swap left traces on two public ledgers even though it bypassed intermediaries that collect identity information. Lookonchain's report demonstrates that cross-chain activity is not invisible — it is only harder to stitch together without specialized tooling. It is a dynamic that is reshaping expectations for follow-the-money work, which increasingly has to reconcile activity across multiple public ledgers rather than rely on the records of a single centralized venue.

It remains important to separate a reported transaction route from a definitive conclusion about the funds' ultimate control. On-chain analysis can establish that assets moved from wallet A to wallet B through protocol C, but proving real-world custody, intent, or identity requires additional investigative steps beyond what public blockchain data alone can confirm.

What the Report Could Mean for On-Chain Monitoring

The Lookonchain report underscores a tension that has defined post-hack forensics in crypto: on-chain data is transparent, but attribution is probabilistic. Blockchain transaction analysis can follow the money across chains, yet the gap between "this wallet moved these funds" and "this person controls this wallet" remains a legal and investigative challenge. In practical terms, specialists can trace value as it crosses chains, but tying an address to a specific individual or entity demands evidence that blockchain records by themselves do not provide. In practice, wallet attributions rest on address-clustering and behavioral heuristics rather than direct identification, which is why independent forensic confirmation carries so much weight. Reports of this kind should be independently corroborated before they form the basis of enforcement action or firm conclusions.

The ripple effects of the $6.3 billion hack extended beyond the directly affected assets. Following the event, XRP added nearly 8,000 new wallets in a surge that analysts tied to the broader market dislocation caused by the hack. Meanwhile, bullish analysts attempting to frame the hack's aftermath positively faced pushback from stablecoin data that complicated their narrative. The downstream effects of the incident have been wide and varied.

For exchanges and compliance teams, the reported THORChain routing is a signal that cross-chain bridges and decentralized swap layers warrant the same monitoring attention as centralized trading venues. If a wallet flagged in connection with a $6.3 billion theft can route funds across chains in a way that takes specialized tooling to detect, the case for broader cross-chain transaction monitoring becomes harder to dismiss. For observers following the case, the near-term markers are concrete: whether independent forensics firms publicly corroborate the wallet attribution, and whether further on-chain movements extend or break the reported staged-conversion pattern.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.