Binance Hacker Moves $96M in Stolen Solana to Bitcoin as Laundering Efforts Continue

On November 1, the wallet associated with the incident transferred approximately 486,970 SOL, valued at $46.4 million, toward Bitcoin through cross-chain service Relay Protocol.

The latest movement involves a reported stash of 970,522 SOL, worth approximately $95.9 million. The conversion marks another stage in the attacker’s efforts to move stolen cryptocurrency across blockchain networks, complicating efforts by exchanges and security firms to monitor and restrict the funds.

Lookonchain identified the activity through an address labeled as belonging to the Binance attacker on Arkham Intelligence. Its November 1 post stated: “The Binance hacker is swapping the stolen 970,522 SOL ($95.9M) for BTC.”

Lookonchain reported that the hacker behind the $6.3 billion Binance-related breach is converting 970,522 stolen SOL, worth approximately $96 million, into Bitcoin. Source: @lookonchain via X

The 486,970 SOL transfer represents approximately half of the reported holdings. The remaining balance was valued at roughly $49.5 million at the time of the reported transactions. The figures describe the reported conversion pool and its initial movement, rather than a confirmed $95.9 million Bitcoin transfer completed in a single transaction.

Relay Protocol facilitates cross-chain cryptocurrency swaps by connecting users with different blockchain networks and liquidity sources. Its involvement provides another route for transferring assets between Solana and Bitcoin. However, the use of a cross-chain service does not automatically remove the transaction history or make the funds untraceable.

The latest conversion also follows earlier movements involving other stolen cryptocurrencies. Law enforcement officials have been monitoring the attacker’s wallet activity as investigators and blockchain intelligence companies work to identify transactions linked to the breach.

The latest transactions come after the FBI formally attributed the October 29 Binance attack to North Korea’s state-sponsored cyber operation known as TraderTraitor. The agency announced its findings on October 31, confirming that North Korea was responsible for stealing more than $6 billion in cryptocurrency from the exchange.

The FBI attributed the record $6.3 billion cryptocurrency theft from Binance on October 29, 2026, to North Korea’s TraderTraitor hacking group, identifying it as the largest known crypto heist. Source: FBI Cyber Branch via X

Blockchain intelligence firm TRM Labs had previously identified TraderTraitor as the group behind the incident. Its investigation estimated that approximately $6.36 billion in digital assets was transferred from Binance wallets across ten blockchain networks, with most of the withdrawals occurring within roughly 20 minutes.

The FBI also identified the hackers’ efforts to convert stolen assets, primarily into Ethereum. It warned that the attackers could move the funds through decentralized finance platforms and instant cryptocurrency swap services to facilitate additional laundering.

In its statement, the agency warned of “further laundering” through related technologies and urged cryptocurrency exchanges, blockchain operators, analytics companies, and other service providers to block transactions associated with the identified addresses.

The latest SOL-to-BTC activity adds another layer to those concerns. Although the FBI previously highlighted Ethereum conversions, the movement reported by Lookonchain shows that the attacker is also using cross-chain infrastructure to move assets into Bitcoin.

Binance has continued replenishing the assets affected by the security breach while coordinating with law enforcement and industry partners to trace the stolen funds.

On November 1, the exchange confirmed that it had covered approximately 95% of the affected amount, up from 90% in its October 31 recovery update. The remaining 5% consists of less-liquid tokens that may require additional time to acquire through market purchases and over-the-counter transactions.

Binance has expanded withdrawal services to include DOGE on its native network and ETH, USDT, and USDC on Optimism, following earlier resumptions across BTC, ETH, BSC, XRP, and Base. Source: Binance via X

The replenishment effort has involved the Secure Asset Fund for Users (SAFU), a portion of the Futures Insurance Fund, and Binance’s corporate treasury. The exchange has repeatedly stated that customers will not bear the financial impact of the attack.

“Binance will absorb the financial impact of the stolen funds, not our users,” the company said in its security incident updates.

The exchange also began restoring withdrawal services in phases on November 1 after temporarily suspending withdrawals while conducting security reviews. The initial phase covered several networks and assets, including Bitcoin, Ethereum, BNB, Solana, XRP, and Dogecoin. Binance said it would gradually restore additional services as security checks were completed.

The company separately reported that approximately $3 billion in affected assets had been frozen on-chain through coordination with law enforcement, blockchain intelligence firms, asset issuers and other industry participants. This represents a separate enforcement and recovery effort from Binance’s own asset-replenishment commitment.

Moving stolen cryptocurrency into Bitcoin can create additional challenges for investigators, particularly when transactions pass through multiple networks and wallet addresses.

Unlike centralized stablecoins, which issuers can freeze at the token-contract level, Bitcoin does not have a central authority capable of freezing funds across its network. However, this does not mean that Bitcoin transactions are anonymous or impossible to trace. Its public blockchain records transactions, allowing investigators and analytics firms to follow fund movements between addresses.

Cross-chain services can complicate that process by splitting transactions across different networks and liquidity providers. Investigators may need to connect activity across multiple blockchain records to establish where assets move after each conversion. Exchanges and other regulated service providers can also restrict deposits and withdrawals associated with identified addresses.

The FBI’s request for cryptocurrency businesses and infrastructure providers to block transactions linked to TraderTraitor reflects the importance of coordinated action in containing the movement of stolen assets. Binance has also credited industry partners for helping freeze funds and track transactions following the October 29 breach.

For now, the reported movement of nearly $46.4 million in Solana toward Bitcoin remains an important development in the ongoing investigation. Whether the attacker can move the entire $95.9 million pool into BTC remains to be established. Meanwhile, the combination of public blockchain monitoring, transaction screening, and cooperation among industry participants will remain central to efforts to trace the stolen funds and prevent further transfers.