The actors behind the Binance exploit have begun converting stolen Solana holdings into Bitcoin. Analytics monitor Lookonchain tracked the transfer of 486,970 Solana tokens, valued at 46.4 million dollars, executed through the cross-chain bridge Relay.
The Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC.
In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol.https://t.co/2a9Oz59mn0 pic.twitter.com/fSPdkstlxp
— Lookonchain (@lookonchain) November 1, 2026
The security incident compromised hot wallets on Thursday. To safeguard platform operations and user balances, Binance covered all losses directly from corporate reserves before restoring standard withdrawal channels on Sunday, November 1, 2026.
1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone, out of the $3.5 billion they still controlled after the freezes.
Here is the full analysis of the laundering from my tracing 🧵 pic.twitter.com/QvawpJ7re5
— SomaXBT (@somaxbt) November 1, 2026
Stablecoin issuers Tether and Circle quickly blacklisted nearly 3 billion dollars in compromised assets. However, an independent audit by SomaXBT tracked remaining capital, confirming that roughly 3.5 billion dollars remained under the attackers’ technical control.
Despite unprecedented net outflows from the exchange over subsequent sessions, the broader crypto market maintained operational liquidity without experiencing the cascading counterparty failures seen in previous industry bankruptcies.
Chainalysis identified high-frequency automated transfers designed to obfuscate transaction trails across Tron. The firm logged approximately 500 million dollars in gross transfer volume across temporary accounts before laundering activity expanded to Solana.
Addressing those transaction metrics, SomaXBT verified that net outflows from Tron totaled 242 million dollars. The larger aggregate figure stemmed from internal routing loops where funds bounced repeatedly through recycled intermediate addresses.
A fraction of the proceeds reached centralized custody on Monday, November 2, 2026. Lookonchain flagged deposits totaling 250,000 dollars sent to Gate, which subsequently immobilized two associated user profiles.
Following the initial breach, an advisory by the FBI linked the theft to North Korea-backed group TraderTraitor. The agency, alongside IRS Criminal Investigation, instructed THORChain node operators and swap protocols to filter flagged addresses.
Federal investigators noted that the attackers initially converted most illicit proceeds into Ether. Multi-agency asset tracing remains active across the designated addresses published by US law enforcement.
Este artículo tiene fines informativos y no constituye asesoramiento financiero. This article is for informational purposes only and does not constitute financial advice.
