Cointelegraph reports that the Binance hacker has transferred 81% of stolen SOL, with the funds moved cross-chain through THORChain. The total size, USD value, timing, and hacker identity remain undisclosed.
According to Cointelegraph, there is the latest development in the handling of large-scale stolen funds from Binance: the hacker has transferred 81% of the stolen SOL, and the funds moved cross-chain through THORChain. The incident involves both Solana assets and a cross-chain money laundering route, and is classified as a high-impact, time-sensitive security incident. Confirmed information currently includes the transfer percentage, the cross-chain channel, and the asset category; however, the total size of the stolen SOL, the corresponding amount, the timing of the transfer, and the hacker's specific identity have not been disclosed.
In terms of entities involved, core elements include Binance, the hacker who carried out the transfer, the stolen SOL, and THORChain. Binance is the platform associated with the large-scale stolen funds, SOL is the asset involved, and THORChain is explicitly identified as the cross-chain channel through which the funds were transferred. The original report describes the actor as the Binance hacker but does not disclose their specific identity; therefore, hacker should be understood as the party that carried out the attack and transferred the funds, while information such as organizational affiliation and on-chain addresses remains to be confirmed. The source is Cointelegraph; the original material did not provide a specific publication time, and subsequent reporting should not independently add time information.
Cross-chain movement is a key reason the incident has drawn attention. Existing information links THORChain to a cross-chain money laundering route, meaning the stolen SOL did not remain confined to a single on-chain network but entered a cross-chain flow scenario. The 81% figure indicates that most of the stolen SOL has left its original controllable or traceable state and entered a new stage of circulation. Because THORChain is explicitly named as the transfer channel, the focus has expanded from Binance itself to cross-chain fund flows, with the market beginning to watch which nodes the funds pass through, whether they can continue to be identified, and the role of cross-chain channels. At the same time, because the asset involved is SOL, security issues in the Solana ecosystem and risk controls for cross-chain channels have both come into view. The incident is no longer merely a security issue at a single exchange; it extends to asset tracing and compliance challenges in a multi-chain environment.
A clear boundary should be maintained between confirmed facts and unconfirmed information. Confirmed facts include: SOL assets among the large-scale stolen funds from Binance have been transferred; the transfer percentage is 81%; the transfer route involves THORChain; and the incident is classified as a high-impact security event. Information yet to be confirmed includes: the total size of the stolen SOL and the specific amount corresponding to 81%, the corresponding USD value, the start and end times of the transfer, the status of the remaining assets, and whether relevant platforms have taken handling measures. For a security incident, these information gaps directly affect judgment about the complete fund chain, so reporting should distinguish confirmed facts from unconfirmed information and avoid equating the term hacker with a specific identity having been identified.
From a security-impact perspective, the incident's impact is reflected at three levels. First, exchange security: new progress in the transfer of large-scale stolen funds from Binance will draw market attention to the handling status of stolen assets and the exchange's response capacity. Second, assets: the asset involved is SOL, and the incident is directly related to the Solana ecosystem, bringing Solana ecosystem security issues and cross-chain channel risk controls into view at the same time. Third, cross-chain: THORChain is named as the transfer channel, exposing cross-chain fund monitoring, compliance, and risk control to greater scrutiny. Compared with pure price volatility or product launches, the information value of this type of security incident lies in verifiable on-chain actions and percentage data, rather than market sentiment or project narratives. The 81% transfer ratio, the THORChain route, and the SOL asset attribute together form the current factual framework that can be reported.
In crypto industry financial reporting, security incidents, market conditions, regulatory policy, and project developments belong to different information categories. The core of this incident is that 81% of the SOL in Binance's large-scale stolen funds has been transferred and the route involves THORChain; it should not be conflated with price movements or regulatory expectations. Its news value comes from clear handling progress: first, the high transfer percentage indicates that most stolen assets have entered a new state of circulation; second, the cross-chain channel is named, indicating that the incident involves a multi-chain environment; third, the asset is SOL, making Solana ecosystem security a related issue. Organizing these facts helps keep discussion focused on fund tracing, security handling, and cross-chain risk identification, rather than generalizing into a judgment on the overall market. Current reporting boundaries should be limited to the disclosed transfer percentage, channel, and asset category, without extended analysis of subsequent market trends.
At present, several key details remain unclear. The total size of the stolen SOL, the specific asset amount corresponding to 81%, the start and end times of the transfer, whether the remaining assets are still traceable, whether relevant platforms have taken handling measures, and whether THORChain has commented on the relevant fund movements have not been provided in the available information. Matters worth following include whether more on-chain information about the destination of funds emerges, whether relevant parties disclose handling progress, and whether there are new changes in the cross-chain route. For the market, what can currently be confirmed is that most of the stolen SOL has been transferred and moved through THORChain; before more facts are disclosed, no additional inferences should be made about the outcome. Reporting should continue to be bounded by the confirmed percentage, route, and asset category, and wait for subsequent information to complete the full picture.
.jpg)