TL;DR
- Binance attackers moved 486,970 SOL worth $46.4 million and began swapping into Bitcoin through Relay as laundering activity expanded beyond Tron.
- SomaXBT estimated $242 million actually left Tron holding wallets, warning that roughly $500 million in observed transfers included repeated movements rather than fresh outflows.
- The shift into Bitcoin complicates recovery because BTC lacks issuer-level freezing, although transactions remain traceable and cooperating exchanges or services can intercept identified funds.
The attackers behind Binance’s $6.3 billion breach have begun converting stolen Solana assets into Bitcoin, extending a laundering sequence that previously moved heavily through Tron. Lookonchain reported that 486,970 SOL, worth about $46.4 million, was transferred and swapped for BTC through Relay. The shift highlights why Bitcoin’s censorship-resistant settlement model can complicate recovery once stolen value reaches native BTC, even though the resulting transactions remain publicly traceable.
The Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC.
In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol.https://t.co/2a9Oz59mn0 pic.twitter.com/fSPdkstlxp
— Lookonchain (@lookonchain) November 1, 2026
Cross-Chain Laundering Expands From Tron Into Solana and Bitcoin
Most temporary holding wallets on Tron had already been emptied as the activity expanded toward Solana. The apparent $500 million in Tron transfers should not be read as $500 million leaving those wallets, because laundering flows included repeated movements between addresses. SomaXBT estimated that about $242 million actually exited the Tron holding wallets, while the attackers still controlled roughly $3.5 billion overall. That distinction prevents repeated transfers from being mistaken for additional stolen capital.
1/ Binance exploit just passed 2 days, and so far the attackers (laundering team) have laundered ~$242M through the Tron leg alone, out of the $3.5 billion they still controlled after the freezes.
Here is the full analysis of the laundering from my tracing 🧵 pic.twitter.com/QvawpJ7re5
— SomaXBT (@somaxbt) November 1, 2026
The Solana phase involved moving nearly half a million SOL into a route that converted the tokens into Bitcoin. Using cross-chain infrastructure can change the form and network location of stolen assets without breaking their onchain history. Similar behavior appeared when the Bitget attacker converted stolen ETH into BTC through THORChain, illustrating how attackers may favor native assets that lack issuer-level freezing controls once centralized tokens become easier to block.
The broader pattern also resembles earlier North Korea-linked laundering sequences. Cross-chain conversions can spread funds across networks, addresses and services while creating additional tracing points for investigators. During the KelpDAO incident, attackers routed stolen assets into Bitcoin through THORChain, while separate Lazarus-linked wallets later moved $30 million through Hyperliquid and several blockchains. Those precedents show that network changes can complicate recovery without making the trail automatically disappear.
The latest movements therefore mark a new laundering phase rather than evidence that the stolen funds have become untraceable. Bitcoin can still be followed address by address, and cooperating exchanges or centralized services can intervene if identified funds reach their infrastructure. The challenge grows when assets remain in self-custodied wallets or move through permissionless cross-chain services. For Binance and investigators, the key question is how much of the remaining attacker-controlled balance can be intercepted before further conversions disperse it across additional networks and counterparties. That makes conversion routes and destination services as important to recovery as the original theft addresses themselves.
