The hacker behind the monumental Binance attack is still buying up more Bitcoin (BTC).

As per the latest blockchain analytics data from Lookonchain dated Nov. 4, the hacker continues to exchange SOL for Bitcoin, moving the stolen assets across several crypto wallets.

The blockchain tracker added that the hacker is using the following multi-step process to exchange the stolen crypto for Bitcoin.

The hacker’s complicated scheme involves splitting his SOL assets among different wallets before selling the SOL for USDC, transferring the USDC from Solana to Ethereum, buying ETH using the USDC and finally exchanging the newly bought ETH for BTC using THORChain, a decentralized cross-chain liquidity protocol.

This long and complicated cross-chain transaction process allows the hacker to easily transfer his funds between different blockchain networks. It also makes it harder to trace the stolen assets.

Hacker targets nearly $100M in stolen Solana

This in not the first time that the hacker has been buying Bitcoin with the stolen funds. In fact, he had earlier been seen making transactions to buy Bitcoin using tens of millions of dollars’ worth of stolen SOL.

As per Lookonchain’s data dated Nov. 1, the hacker behind the Binance hack was trying to convert approximately 970,522 SOL, worth roughly $95.9 million at the time of writing, into Bitcoin.

The hacker was even seen making a transaction involving 486,970 SOL (approximately $46.4M) in just one hour.

However, during these transactions, the hacker used a different service called Relay Protocol, which also allows cross-chain crypto transfers.

From the recent blockchain data, it looks like the hacker is still focused on Bitcoin. He’s also using several decentralized services to exchange the stolen crypto.

Binance hack recovery process

The latest official update from Binance shows that the massive security breach has affected crypto assets worth around $6.34 billion.

As per the update, the exchange says that it has frozen/intercepted about $2.85 billion worth of stolen cryptocurrency as of Nov. 3.

According to US federal authorities, the attack was conducted by a North Korean state-sponsored hacker group called TraderTraitor.

The FBI is also asking various decentralized crypto services like THORChain to prevent funds linked to the attack from moving around.

Even with all these efforts, the latest on-chain data shows that the hacker is still moving stolen funds across different networks.