According to Lookonchain monitoring, the hacker behind the Binance incident is continuously swapping the stolen SOL for BTC. On-chain data shows that the funds were first distributed to multiple wallets to sell SOL for USDC, then cross-chained to Ethereum to purchase ETH, and finally swapped for BTC via THORChain.