BTC $78,080 
ETH $2,268 
MGLOEURO $111,813 
USDT $0.9992 
BNB $711.54 
XRP $1.25 
USDC $0.9997 
SOL $94.72 
TRX $0.3131 
FIGR_HELOC $1.08 Hacks & Security · Explained
Binance hacker moves $46M in stolen SOL through Relay in bitcoin pivot
Lookonchain traced roughly half of a 970,522 SOL holding through a cross-chain swap service, though public records do not confirm completed bitcoin purchases.
Key takeaways
- Half the stack. Lookonchain says the attacker controlled 970,522 SOL worth about $95.9 million and moved 486,970 SOL, worth $46.4 million, in a single hour.
- Route identified. Relay Protocol was named as the swap service based on the transaction path, not through any statement from the company.
- No confirmation. Moving SOL between wallets or through a swap service does not prove a completed bitcoin purchase or show where assets were ultimately sold.
What happened
Wallets tied to the Binance breach have begun shifting a large Solana position toward bitcoin, according to the blockchain tracker Lookonchain. The firm reported that about 486,970 SOL, valued at roughly $46.4 million, moved within a single hour on November 1, with Relay Protocol identified as the service used to route the swaps. Relay provides infrastructure for exchanging and transferring assets between blockchain networks.
Lookonchain put the attacker's total Solana balance at 970,522 tokens, worth approximately $95.9 million at the time of its update, meaning the first wave of transfers covered close to half of the identified holding. The tracker tied the activity to a Solana address that Arkham has labeled as associated with the Binance hacker.
A separate alert from Whale Alert recorded a transfer of 485,270 SOL at 09:39 UTC on November 1, carrying an estimated value of $46.35 million. Those funds left an address labeled "Binance Hack 2026" and arrived at another Solana wallet. The figures broadly match Lookonchain's count, and the two reports may describe the same transactions.
The Solana activity came after an earlier batch of conversions that Lookonchain attributed to the same actor. In that round, more than 130 altcoins were sold across Ethereum-compatible networks for about 123,400 ETH, valued at $277.26 million, plus 1.69 million USDC. One trade stood out: 908,793 PROM tokens, quoted near $5 million, were routed through a Uniswap V2 liquidity pool and returned only 0.0316 ETH, roughly $71.
First $84.5KLatest $77.9K-7.8% over the period
Points are daily observations, not closing prices.
Why it matters
Swapping Solana for bitcoin changes both the asset the attacker holds and the network on which the funds travel, adding another layer to a trail investigators are already tracking across several blockchains. The FBI has asked exchanges, decentralized finance operators, infrastructure providers and analytics firms to block transactions linked to addresses identified as attacker-controlled. Whether Relay can restrict the specific transactions, and whether the receiving bitcoin addresses have been pinpointed, was not established in the initial reporting. The conversions also matter for the exchange's customers and creditors, because the breach has already prompted freezes by major issuers and a staged restoration of withdrawals.
What the data shows
Lookonchain's numbers frame the scale: 970,522 SOL controlled, about $95.9 million in value, and 486,970 SOL moved in an hour for $46.4 million. The earlier altcoin liquidation produced 123,400 ETH and 1.69 million USDC, close to $279 million combined. Market data from Binance showed SOL near $94.76 on November 1, down about 0.99% over 24 hours, within a session range of $94.40 to $96.10 and volume of roughly $1.3 billion. The token had already fallen about 6.6% on October 29, before the reported transfers, which limits how much of the decline the swaps can explain. The FBI has put the breach at more than $6.3 billion in virtual assets.
Background
The breach, dated to October 29, involved compromised wallet authorization controls, with security researchers examining Ethereum transactions that allowed unauthorized withdrawals. On October 31 the FBI attributed the theft to North Korea's TraderTraitor operation and said the group had been converting stolen assets mainly into Ethereum, warning that decentralized platforms and instant-swap services could be used for further laundering. Tether, Circle and other issuers froze affected assets, and Binance said roughly $3 billion was frozen during its initial response. The exchange has pledged to cover customer losses from company resources, said replacements covered about 95% of stolen holdings, began restoring withdrawals on November 1 starting with bitcoin, and added newly generated addresses to its Proof of Reserves list.
What is still unclear
The reports do not show how much bitcoin actually reached final receiving addresses, and a wallet transfer or a route through a swapping service does not by itself demonstrate a completed purchase. Analyst Ted Pillows suggested on X that the hacker's activity explained why Solana looked weak, but that reading remains a hypothesis: the supplied transaction records contain no evidence tying specific transfers to market orders, and cross-chain routing does not imply equivalent spot sales on centralized exchanges. The earlier PROM sale also illustrates how thin liquidity can leave large nominal holdings worth far less in practice.
What to watch
Roughly half of the identified Solana balance had not moved in the first reported wave, so further transfers are the obvious next signal. Also worth tracking: whether the bitcoin side of the route becomes traceable to identified addresses, whether Relay or other services act on the FBI's request, how quickly Binance completes its withdrawal restoration across networks, and whether additional issuer freezes follow as the funds move.
Questions readers ask
How much SOL did the Binance hacker move?
Lookonchain reported that about 486,970 SOL, worth roughly $46.4 million, moved within an hour on November 1, out of a total identified holding of 970,522 SOL valued near $95.9 million.
Was the SOL actually sold for bitcoin?
The reports describe movement through Relay Protocol toward bitcoin conversion, but they do not establish how much BTC reached final addresses, and moving funds between wallets does not prove a completed purchase.
Did the transfers cause SOL's price drop?
That link has been suggested by an analyst but is not established. SOL was already down about 6.6% on October 29, before the reported transfers, and traded near $94.76 on November 1, down about 0.99% over 24 hours.
