Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay
Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the cryptocurrency exchange.
Summary
- Lookonchain says the Binance hacker is converting 970,522 stolen SOL, valued at $95.9 million, into Bitcoin.
- The attacker moved 486,970 SOL worth $46.4 million within one hour, with Relay Protocol identified as the swap route.
- Earlier transactions reportedly converted more than 130 altcoins into $277.26 million in ETH and $1.69 million in USDC.
- A separate PROM token sale reportedly returned only 0.0316 ETH, worth $71, from tokens valued near $5 million.
- The FBI has attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation and urged crypto services to block related funds.
According to Lookonchain’s latest findings, the attacker controlled 970,522 SOL valued at $95.9 million and moved 486,970 SOL worth $46.4 million within an hour. The blockchain tracker identified Relay Protocol as the service being used to swap SOL for BTC.
The activity follows an earlier wave of transactions involving more than 130 altcoins. Investigators have been monitoring the attacker’s movements as U.S. authorities attempt to prevent stolen funds from entering other cryptocurrency services.
Binance hacker routes stolen Solana through Relay Protocol
The latest transactions involve Solana tokens taken during the Binance breach, which affected an estimated $6.3 billion in cryptocurrencies across multiple blockchains.
Lookonchain linked the activity to a Solana wallet tracked by Arkham. The address has been labeled as associated with the Binance hacker.
At the time of the report, the 486,970 SOL movement represented roughly half the stolen SOL identified by Lookonchain.
The tracker described the operation as an ongoing conversion into Bitcoin, although its initial update did not establish how much BTC had reached final receiving addresses.
Relay Protocol provides infrastructure for transferring and exchanging assets between blockchain networks. Its involvement was identified through the transaction route, not through an announcement by the service.
Moving SOL into BTC would change the cryptocurrency held by the attacker while introducing another network into the transaction trail.
Whether Relay can restrict the particular transactions, or whether the receiving Bitcoin addresses have been identified, was not established in the initial report.
Hacker previously converted $279M in stolen altcoins
The Solana transfers follow another batch of asset sales identified by Lookonchain earlier on November 1.
In a separate update, the analytics firm reported that the attacker had sold more than 130 altcoins across Ethereum-compatible networks.
Those transactions returned approximately 123,400 ETH, valued at $277.26 million, alongside another 1.69 million USDC.
The combined proceeds amounted to nearly $279 million, according to the firm’s calculations.
Unlike the latest SOL activity, those figures describe assets that the tracker reported receiving from earlier swaps.
Some sales involved smaller cryptocurrencies with limited trading liquidity, where large orders can receive considerably less than the tokens’ quoted market value.
One transaction involving PROM illustrated the difficulty.
Lookonchain reported that the attacker sold 908,793 PROM tokens, valued near $5 million, through a Uniswap V2 liquidity pool.
The transaction reportedly returned just 0.0316 ETH, worth approximately $71 at the time.
The Ethereum transaction record provides the on-chain reference for the unusual swap.
FBI links Binance attack to North Korea’s TraderTraitor
The latest conversions followed the FBI’s October 31 attribution of the Binance breach to North Korea.
In its official alert, the bureau identified the operation as TraderTraitor and said the attackers stole more than $6 billion in virtual assets.
Investigators said the group had been converting stolen cryptocurrencies primarily into Ethereum and expected further laundering through decentralized finance and instant-swap services.
The FBI, Secret Service and IRS Criminal Investigation called on exchanges, DeFi operators, blockchain infrastructure providers and analytics companies to block transactions connected to identified attacker-controlled addresses.
As crypto.news reported in its investigation, earlier asset freezes restricted billions in stolen cryptocurrencies while other holdings remained transferable.
Tether, Circle and other issuers were among the organizations that froze affected assets. The exchange reported approximately $3 billion frozen during its initial response.
The attack itself involved compromised wallet authorization controls, with blockchain security researchers examining Ethereum transactions that enabled unauthorized withdrawals.
Binance has pledged to cover customer losses using company resources and emergency reserves.
Following the breach, the exchange began restoring withdrawals on November 1, starting with Bitcoin before reopening selected stablecoin and other cryptocurrency networks.
Elsewhere, Binance said its Proof of Reserves address list now includes newly generated wallet addresses. Future customer withdrawals will be processed from those addresses as the company continues replacing affected assets and reviewing its security systems.
