Binance Hackers Move $95.9 Million in Stolen Solana Toward Bitcoin

The attackers behind the record Binance theft are changing lanes again.

Blockchain investigators say wallets tied to the hack have started converting a large block of stolen Solana into Bitcoin, moving the money away from assets and venues where freezes may be easier to enforce.

According to Cointelegraph, the latest movement involves 970,522 SOL worth roughly $95.9 million at the time it was tracked. The report says the activity follows earlier efforts to move stolen value through other chains and decentralized-finance routes.

The new route changes both the asset and the chain investigators must follow. Earlier Solana transactions remain visible on-chain.

Moving the value into Bitcoin can still complicate interception because Bitcoin has no central issuer with protocol-level power to freeze a wallet.

The report also places the move inside a broader laundering sequence rather than treating it as an isolated trade. Investigators are watching the pace of the swaps, the bridges and liquidity services used, and any eventual deposits to centralized venues that can screen or stop funds tied to the theft.

On-chain account Lookonchain said 486,970 SOL, valued at about $46.4 million, moved in one hour as the attacker began swapping SOL for BTC through Relay Protocol.

The Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC.

In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol.https://t.co/2a9Oz59mn0 pic.twitter.com/fSPdkstlxp

— Lookonchain (@lookonchain) November 1, 2026

The swap matters because stolen crypto becomes a race between investigators, issuers, exchanges and the people trying to move it. Stablecoin issuers can freeze tokens they control, while centralized exchanges can flag deposits.

Bitcoin does not have an issuer that can reverse or freeze a transaction at the protocol level.

That does not make Bitcoin invisible. The relevant wallets and transactions remain public, and analytics firms can follow the trail across chains.

The practical question is whether the attackers can find enough liquidity and reach an off-ramp before a service identifies and blocks them.

Chainalysis framed the Solana activity as a new phase of laundering by North Korean-linked actors. The firm said the group moved onto Solana after draining about $500 million from TRON staging wallets, underscoring how quickly the route can change even when investigators retain visibility.

North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance.

After draining $500M from TRON staging wallets, the launderers have started moving onto Solana.

The Reactor graph below shows the scale across blockchains. pic.twitter.com/Pt3az4tJ0Y

— Chainalysis (@chainalysis) November 1, 2026

For SOL holders, the headline number is large enough to watch, but one criminal wallet’s swap is not the same thing as a verdict on the Solana network. The more important near-term issue is execution: how much SOL reaches the market, how quickly the conversion happens, and whether counterparties or bridge operators intervene.

For Bitcoin, the episode is another demonstration of why major thefts do not end when the first wallet is identified. The stolen value can be split, bridged, wrapped and exchanged repeatedly.

Each move creates another set of transactions for investigators to map—and another chance for the attacker to make a costly mistake.

The SOL-to-BTC route is therefore best read as a tactical shift, not a clean escape. The money is moving, and the trail is moving with it.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.