Swap

Read

Greed

Bitcoin

Arkham

<p><strong>The attacker behind the largest crypto hack in history is actively liquidating stolen Solana, with on-chain monitoring platforms reporting that 486,970 SOL, worth roughly $46.4 million, was moved in a single hour as part of a broader conversion of nearly 970,000 SOL into Bitcoin through Relay Protocol.</strong></p>
<h2 id="what-happened-in-the-46-4m-sol-to-bitcoin-swap">What Happened in the $46.4M SOL-to-Bitcoin Swap</h2>
<p>On-chain intelligence platform Arkham and monitoring service Lookonchain identified the movement as part of a larger operation converting <a href="https://www.tokenpost.com/news/investing/45809" rel="noopener noreferrer nofollow">970,522 SOL, valued at approximately $95.9 million</a>, into Bitcoin. Relay Protocol was identified as the cross-chain routing mechanism used to bridge the assets. For related coverage, see <a href="https://www.nftenex.com/kim-jong-un-north-korea-memes-binance-6-3b-hack/" rel="noopener noreferrer nofollow">Kim Jong Un Memes Flood X After Binance’s $6.3B Hack</a>.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #cbd5e1;border-left:5px solid #f59e0b;border-radius:8px;background:#fffaf0;color:#172033;font-family:Arial,Helvetica,sans-serif;max-width:560px">
 <div style="font-size:12px;line-height:1.3;font-weight:700;letter-spacing:0.09em;text-transform:uppercase;color:#9a5b00;margin:0 0 9px 0">
  SOL earmarked for conversion
 </div>
 <div style="font-size:34px;line-height:1.05;font-weight:800;letter-spacing:-0.03em;margin:0 0 10px 0">
  970,522 SOL
 </div>
 <figcaption style="font-size:14px;line-height:1.45;color:#475569;margin:0">
  About $95.9 million, reported as the total position being swapped into Bitcoin via Relay Protocol.
 </figcaption>
</figure>
<p>Of the total position, <a href="https://panews.io/articles/01a196b0-6eeb-705d-aa8b-cdf2164bd7d7" rel="noopener noreferrer nofollow">486,970 SOL (~$46.4M) was moved in the reported hour</a>, with approximately 483,600 SOL (~$46.14M) remaining in the hacker's wallet at the time of reporting, per Arkham data.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #cbd5e1;border-left:5px solid #dc2626;border-radius:8px;background:#fff7f7;color:#172033;font-family:Arial,Helvetica,sans-serif;max-width:560px">
 <div style="font-size:12px;line-height:1.3;font-weight:700;letter-spacing:0.09em;text-transform:uppercase;color:#b91c1c;margin:0 0 9px 0">
  Moved in the reported hour
 </div>
 <div style="font-size:34px;line-height:1.05;font-weight:800;letter-spacing:-0.03em;margin:0 0 10px 0">
  486,970 SOL
 </div>
 <figcaption style="font-size:14px;line-height:1.45;color:#475569;margin:0">
  Roughly $46.4 million of SOL was reported moved as part of the conversion activity.
 </figcaption>
</figure>
<h2 id="phase-2-of-a-6-3b-laundering-operation">Phase 2 of a $6.3B Laundering Operation</h2>
<p>The SOL-to-BTC conversion is not an isolated event. It represents a deliberate second phase following the <a href="https://x.com/arkham/status/2116022327674810570" rel="noopener noreferrer nofollow">theft of $6.01 billion from Binance hot wallets across nine chains</a> between 20:10 and 23:05 UTC on October 29, 2026, an attack Arkham confirmed as the largest crypto hack in history. The attacker's original stablecoin holdings were largely neutralized when Tether, Circle, and Ripple froze a <a href="https://www.nftenex.com/tether-circle-freeze-2-39b-binance-security-issue/" rel="noopener noreferrer nofollow">combined $2.80 billion</a> in stolen assets, eliminating that portion of the haul as a usable exit route.</p>
<p>With stablecoins frozen, the attacker pivoted to Solana holdings, now routing them through Relay Protocol into Bitcoin. BTC's deeper liquidity, at a <a href="https://www.coingecko.com/en/coins/bitcoin" rel="noopener noreferrer nofollow">market cap of approximately $1.567 trillion</a>, makes large inflows harder to detect and freeze than equivalent stablecoin movements. SOL is currently trading at $95.28, meaning the full 970,522 SOL position represents sustained sell pressure on an already stressed market. The <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear and Greed Index</a> sits at 34, firmly in "Fear" territory, following the October 29 attack.</p>
<p>The attack itself exploited EIP-7702 on Ethereum, which allowed the attacker to convert a Binance hot wallet into an attacker-controlled sweeper via 50 pre-signed authorizations, combined with access gained through a compromised DevOps engineer's laptop, according to <a href="https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225" rel="noopener noreferrer nofollow">technical reporting by The Block</a>. The <a href="https://www.nftenex.com/binance-hack-1-5b-crypto-liquidations/" rel="noopener noreferrer nofollow">resulting liquidation cascade</a> across the broader market underscored how interconnected exchange infrastructure risk is with DeFi protocols.</p>
<h2 id="north-korean-attribution-and-what-remains-at-risk">North Korean Attribution and What Remains at Risk</h2>
<p>The FBI, Chainalysis, and TRM Labs have attributed the Binance hack to North Korea's TraderTraitor hacking unit with high confidence. Chainalysis posted on X that investigators observed funds from the attack commingling with proceeds from the prior Bitget exploit, a pattern consistent with DPRK laundering methodology.</p>
<blockquote style="border-left:4px solid #e040fb;margin:20px 0;padding:12px 20px;background:#0d0d17;color:#e6edf3;border-radius:4px;margin:20px 0;padding:16px 18px;border-left:4px solid #e040fb;background:#1a0d17;color:#f3f4f6;border-radius:10px;margin:20px 0;padding:16px 18px;border-left:4px solid #e040fb;background:#1a0d17;color:#f3f4f6;border-radius:10px">
 "Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance." <br><em>-- <a href="https://x.com/chainalysis/status/2116025255965999217" rel="noopener noreferrer nofollow">Chainalysis (@chainalysis) on X</a></em>
</blockquote>
<p>TRM Labs estimates North Korea has stolen approximately $7.4 billion in crypto in 2026 alone, bringing the regime's total since 2017 to roughly $12.8 billion. The Binance attack follows a now-familiar playbook: exploit exchange signing infrastructure, drain across multiple chains simultaneously, and convert traceable bridged assets into Bitcoin before moving to mixers.</p>
<p>Binance co-CEO Richard Teng stated "Your money is safe, and we're covering every loss," and the exchange <a href="https://www.theblock.co/news/ecosystems/2026-10-30-binance-says-it-has-6-34-billion-ready-to-cover-hack-losses-432208" rel="noopener noreferrer nofollow">allocated $6.34 billion in reserves</a> to cover losses. By November 1, Binance confirmed 90% of stolen assets had been replenished. The <a href="https://www.nftenex.com/binance-hack-why-bitcoin-didnt-crash-like-2018/" rel="noopener noreferrer nofollow">muted Bitcoin price response</a> compared to historical exchange hacks reflects both the depth of current BTC liquidity and confidence in Binance's reserve position, with BTC trading at $77,922, up 0.70% on the day despite the attacker's active conversion.</p>
<h2 id="why-the-movement-matters-for-on-chain-tracking">Why the Movement Matters for On-Chain Tracking</h2>
<p>Each asset conversion event is a trackable on-chain moment. When the attacker routes SOL through Relay Protocol into BTC, it creates a new wallet cluster that blockchain forensics firms can link to the original Binance exploit addresses, extending the investigative trail. The absence of published transaction hashes for the specific 486,970 SOL movement limits independent verification at this stage; Arkham and Lookonchain are the cited monitoring sources, but raw on-chain explorer data has not been published in available reporting.</p>
<p>The FBI has urged private-sector entities to block transactions from identified hacker addresses, and the <a href="https://www.nftenex.com/aave-reopens-markets-binance-hack-nine-assets-zero-ltv/" rel="noopener noreferrer nofollow">broader DeFi ecosystem has responded</a> by tightening collateral parameters on assets exposed to the hack. The remaining approximately $2.9 billion in ETH, BTC, TRX, SOL, and altcoins confirmed as still movable by Arkham means the active conversion phase is likely to continue as investigators race to map and flag new wallet addresses before funds reach mixers or over-the-counter desks.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.nftenex.com/?p=11631" rel="noopener noreferrer nofollow">Read original article on nftenex.com</a>

Binance Hacker Swaps $46.4M in Stolen SOL for Bitcoin

Table of Contents

NFTENEX

Other articles published on Nov 1, 2026

Join our free newsletter for daily crypto updates!