Secret

Solana

Uniswap

Bitcoin

Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the cryptocurrency exchange.
<div id="cn-block-summary-block_081213555241aa3a6915e2f0295b54a2" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">Summary
 </div>
 <div class="cn-block-summary__content">
 <ul>
 <li>Lookonchain says the Binance hacker is converting 970,522 stolen SOL, valued at $95.9 million, into Bitcoin.</li>
 <li>The attacker moved 486,970 SOL worth $46.4 million within one hour, with Relay Protocol identified as the swap route.</li>
 <li>Earlier transactions reportedly converted more than 130 altcoins into $277.26 million in ETH and $1.69 million in USDC.</li>
 <li>A separate PROM token sale reportedly returned only 0.0316 ETH, worth $71, from tokens valued near $5 million.</li>
 <li>The FBI has attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation and urged crypto services to block related funds.</li>
 </ul>
 </div>
</div>
According to Lookonchain’s latest findings, the attacker controlled 970,522 SOL valued at $95.9 million and moved 486,970 SOL worth $46.4 million within an hour. The blockchain tracker identified Relay Protocol as the service being used to swap SOL for BTC.
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 The Binance hacker is swapping the stolen 970,522 <a href="https://x.com/search?q=%24SOL&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SOL</a> ($95.9M) for <a href="https://x.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a>. In the past hour, the hacker moved 486,970 <a href="https://x.com/search?q=%24SOL&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SOL</a> ($46.4M) and is now swapping <a href="https://x.com/search?q=%24SOL&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SOL</a> for <a href="https://x.com/search?q=%24BTC&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$BTC</a> through <a href="https://x.com/RelayProtocol?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@RelayProtocol</a>.<a href="https://t.co/2a9Oz59mn0" rel="noopener noreferrer nofollow">https://t.co/2a9Oz59mn0</a><a href="https://t.co/fSPdkstlxp" rel="noopener noreferrer nofollow">pic.twitter.com/fSPdkstlxp</a>— Lookonchain (@lookonchain) <a href="https://x.com/lookonchain/status/2116841508599144917?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 1, 2026</a>
 </blockquote>
 </div>
</figure>
The activity follows an earlier wave of transactions involving more than 130 altcoins. Investigators have been monitoring the attacker’s movements as U.S. authorities attempt to prevent stolen funds from entering other cryptocurrency services.
<h2 class="wp-block-heading" id="strong-binance-hacker-routes-stolen-solana-through-relay-protocol-strong">Binance hacker routes stolen Solana through Relay Protocol</h2>
The latest transactions involve Solana tokens taken during the Binance breach, which affected an estimated $6.3 billion in cryptocurrencies across multiple blockchains.
Lookonchain linked the activity to a Solana <a href="https://arkm.com/explorer/address/AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU" rel="noopener noreferrer nofollow">wallet</a> tracked by Arkham. The address has been labeled as associated with the Binance hacker.
At the time of the report, the 486,970 SOL movement represented roughly half the stolen SOL identified by Lookonchain.
The tracker described the operation as an ongoing conversion into Bitcoin, although its initial update did not establish how much BTC had reached final receiving addresses.
You might also like: <a href="https://crypto.news/binance-tapped-its-insurance-fund-after-the-hack-whats-left/" rel="noopener noreferrer nofollow"> Binance tapped its insurance fund after the hack. What’s left? </a>
Relay Protocol provides infrastructure for transferring and exchanging assets between blockchain networks. Its involvement was identified through the transaction route, not through an announcement by the service.
Moving SOL into BTC would change the cryptocurrency held by the attacker while introducing another network into the transaction trail.
Whether Relay can restrict the particular transactions, or whether the receiving Bitcoin addresses have been identified, was not established in the initial report.
<h2 class="wp-block-heading" id="strong-hacker-previously-converted-279m-in-stolen-altcoins-strong">Hacker previously converted $279M in stolen altcoins</h2>
The Solana transfers follow another batch of asset sales identified by Lookonchain earlier on November 1.
In a separate update, the analytics firm <a href="https://x.com/lookonchain/status/2116789401342894421" rel="noopener noreferrer nofollow">reported</a> that the attacker had sold more than 130 altcoins across Ethereum-compatible networks.
Those transactions returned approximately 123,400 ETH, valued at $277.26 million, alongside another 1.69 million USDC.
The combined proceeds amounted to nearly $279 million, according to the firm’s calculations.
Unlike the latest SOL activity, those figures describe assets that the tracker reported receiving from earlier swaps.
Some sales involved smaller cryptocurrencies with limited trading liquidity, where large orders can receive considerably less than the tokens’ quoted market value.
One transaction involving PROM illustrated the difficulty.
Lookonchain <a href="https://x.com/lookonchain/status/2116746249097666777" rel="noopener noreferrer nofollow">reported</a> that the attacker sold 908,793 PROM tokens, valued near $5 million, through a Uniswap V2 liquidity pool.
The transaction reportedly returned just 0.0316 ETH, worth approximately $71 at the time.
The <a href="https://etherscan.io/tx/0x38546f9087ba0eb8444965711eb64a89fe9f53e80cd6d416317c847308219164" rel="noopener noreferrer nofollow">Ethereum transaction record</a> provides the on-chain reference for the unusual swap.
<h2 class="wp-block-heading" id="strong-fbi-links-binance-attack-to-north-korea-s-tradertraitor-strong">FBI links Binance attack to North Korea’s TraderTraitor</h2>
The latest conversions followed the FBI’s October 31 attribution of the Binance breach to North Korea.
In its <a href="https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack" rel="noopener noreferrer nofollow">official alert</a>, the bureau identified the operation as TraderTraitor and said the attackers stole more than $6 billion in virtual assets.
Investigators said the group had been converting stolen cryptocurrencies primarily into Ethereum and expected further laundering through decentralized finance and instant-swap services.
The FBI, Secret Service and IRS Criminal Investigation called on exchanges, DeFi operators, blockchain infrastructure providers and analytics companies to block transactions connected to identified attacker-controlled addresses.
As crypto.news <a href="https://crypto.news/binance-hack-what-happened-and-where-the-6-3-billion-went/" rel="noopener noreferrer nofollow">reported in its investigation</a>, earlier asset freezes restricted billions in stolen cryptocurrencies while other holdings remained transferable.
Tether, Circle and other issuers were among the organizations that froze affected assets. The exchange reported approximately $3 billion frozen during its initial response.
The attack itself involved <a href="https://crypto.news/binance-hack-eip-7702-wallet-attack/" rel="noopener noreferrer nofollow">compromised wallet authorization controls</a>, with blockchain security researchers examining Ethereum transactions that enabled unauthorized withdrawals.
Binance has pledged to cover customer losses using company resources and emergency reserves.
Following the breach, the exchange <a href="https://crypto.news/binance-reopens-bitcoin-withdrawals-after-hack/" rel="noopener noreferrer nofollow">began restoring withdrawals</a> on November 1, starting with Bitcoin before reopening selected stablecoin and other cryptocurrency networks.
Elsewhere, Binance <a href="https://x.com/binance/status/2116785774540787920" rel="noopener noreferrer nofollow">said</a> its Proof of Reserves address list now includes newly generated wallet addresses. Future customer withdrawals will be processed from those addresses as the company continues replacing affected assets and reviewing its security systems.
Read more: <a href="https://crypto.news/why-is-ethereum-price-up-today/" rel="noopener noreferrer nofollow"> Why is Ethereum price up today as ETH targets $2,300 recovery? </a>

Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay

Table of Contents

crypto.news

Other articles published on Nov 1, 2026

Join our free newsletter for daily crypto updates!