Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay

cryptonews11-01 19:36

Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2680201879?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-11-01 19:36","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2680201879","market":"other","top_or_hot":-1,"title":"Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay","media":"cryptonews","content":"<div>\n<p>Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the ...</p>\n\n<a href=\"https://crypto.news/binance-hacker-sol-bitcoin-swaps-relay-protocol/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBinance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-11-01 19:36 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/binance-hacker-sol-bitcoin-swaps-relay-protocol/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the ...</p>\n\n<a href=\"https://crypto.news/binance-hacker-sol-bitcoin-swaps-relay-protocol/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BITQ","symbol_name":"Bitwise Crypto Industry Innovators ETF","start_time":0,"source_url":"https://crypto.news/binance-hacker-sol-bitcoin-swaps-relay-protocol/","article_id":"2680201879","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/binance-hacker-sol-bitcoin-swaps-relay-protocol/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2680201879","pubTimestamp":1793532961,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana  toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the cryptocurrency exchange.Lookonchain says the Binance hacker is converting 970,522 stolen SOL, valued at $95.9 million, into Bitcoin.The attacker moved 486,970 SOL worth $46.4 million within one hour, with Relay Protocol identified as the swap route.Earlier transactions reportedly converted more than 130 altcoins into $277.26 million in ETH and $1.69 million in USDC.A separate PROM token sale reportedly returned only 0.0316 ETH, worth $71, from tokens valued near $5 million.The FBI has attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation and urged crypto services to block related funds.According to Lookonchain’s latest findings, the attacker controlled 970,522 SOL valued at $95.9 million and moved 486,970 SOL worth $46.4 million within an hour. The blockchain tracker ident","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BITQ":"Bitwise Crypto Industry Innovators ETF","QETH":"以太坊ETF-Invesco Galaxy","YETH":"Roundhill Ether Covered Call Strategy ETF","09008":"博时比特币-U","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","STCE":"Schwab Crypto Thematic ETF","BKCH":"AdvisorShares Sabretooth ETF","ETHT":"ProShares Ultra Ether ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF","IBIT":"比特币ETF-iShares","BTYB":"VistaShares BitBonds 5 Yr Enhanced Weekly Distribution ETF","ETHU":"2倍以太币期货ETF-Volatility Shares","HECO":"SPDR Galaxy Hedged Digital Asset Ecosystem ETF","SOLM":"Amplify Solana 3% Monthly Option Income ETF","SOL.AU":"WASHINGTON H. SOUL PATTINSON","SETH":"1倍做空以太币期货ETF-Proshares","BTF":"比特币&以太币期货ETF-CoinShares","ETHV":"以太坊ETF-VanEck","SOLX":"T-REX 2X Long SOL Daily Target ETF","ETH":"低成本以太坊ETF-Grayscale","ETHW":"以太坊ETF-Bitwise","GSOL":"Grayscale Solana Trust ETF","ETHA":"以太坊ETF-iShares","SOLZ":"Solana ETF","AETH":"以太坊策略ETF-Bitwise","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","SSK":"Rex-Osprey SOL + Staking ETF","09439":"嘉实比特币-U","FETH":"以太币ETF-Fidelity","BETE":"等权重比特币&以太币期货ETF-ProShares","ARKY":"ARK Active Autocallable Income ETF","BETH":"比特币&以太币期货ETF-ProShares","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","ETHD":"ProShares UltraShort Ether ETF","EETH":"以太币期货ETF-ProShares","GDLC":"Grayscale CoinDesk Crypto 5 ETF","09042":"华夏比特币-U","SLON":"ProShares Ultra Solana ETF","ETHE":"最大以太坊ETF-Grayscale","EZET":"以太坊ETF-Franklin","OOQB":"One+One Bitcoin and Ether ETF","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","BSOL":"Bitwise Solana Staking ETF","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF"},"translate_title":"币安黑客通过中继转移被盗的 4600 万美元 SOL 进行比特币掉期","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"GSOL":1.5,"09042":1.5,"ETHW":0.9,"BTF":0.9,"ETHE":0.9,"GDLC":0.9,"ETHA":0.9,"IBIT":1.5,"BSOL":1.5,"BETH":0.9,"ETH":0.9,"CRPT":0.9,"AETH":0.9,"SETH":0.6,"FETH":0.9,"ETQ":0.6,"ETHD":0.9,"BKCH":0.9,"ETU":0.9,"SOLX":1.5,"ETHU":0.9,"BITQ":0.9,"SOLM":0.9,"SLON":1.5,"SOL.AU":1,"ETHV":0.9,"EZET":0.9,"EETH":0.9,"YETH":0.9,"OOQB":1.5,"LFGY":0.9,"ARKY":0.9,"09008":1.5,"SSK":1.5,"STCE":0.9,"BTYB":1.5,"METHmain":0.9,"ETTY":0.9,"HECO":0.81,"QETH":0.9,"BETE":0.9,"09439":1.5,"ETHT":0.9,"BEGS":0.9,"SOLZ":0.9,"NCIQ":0.9},"content_text":"Binance hacker-linked wallets have begun moving nearly $96 million in stolen Solana (SOL) toward Bitcoin conversions, opening another round of asset transfers after the October 29 attack on the cryptocurrency exchange.\n\n\nSummary\n\n\n\nLookonchain says the Binance hacker is converting 970,522 stolen SOL, valued at $95.9 million, into Bitcoin.\nThe attacker moved 486,970 SOL worth $46.4 million within one hour, with Relay Protocol identified as the swap route.\nEarlier transactions reportedly converted more than 130 altcoins into $277.26 million in ETH and $1.69 million in USDC.\nA separate PROM token sale reportedly returned only 0.0316 ETH, worth $71, from tokens valued near $5 million.\nThe FBI has attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation and urged crypto services to block related funds.\n\n\n\nAccording to Lookonchain’s latest findings, the attacker controlled 970,522 SOL valued at $95.9 million and moved 486,970 SOL worth $46.4 million within an hour. The blockchain tracker identified Relay Protocol as the service being used to swap SOL for BTC.\n\nThe Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC.In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol.https://t.co/2a9Oz59mn0 pic.twitter.com/fSPdkstlxp— Lookonchain (@lookonchain) November 1, 2026\n\nThe activity follows an earlier wave of transactions involving more than 130 altcoins. Investigators have been monitoring the attacker’s movements as U.S. authorities attempt to prevent stolen funds from entering other cryptocurrency services.\nBinance hacker routes stolen Solana through Relay Protocol\nThe latest transactions involve Solana tokens taken during the Binance breach, which affected an estimated $6.3 billion in cryptocurrencies across multiple blockchains.\nLookonchain linked the activity to a Solana wallet tracked by Arkham. The address has been labeled as associated with the Binance hacker.\nAt the time of the report, the 486,970 SOL movement represented roughly half the stolen SOL identified by Lookonchain.\nThe tracker described the operation as an ongoing conversion into Bitcoin, although its initial update did not establish how much BTC had reached final receiving addresses.\nRelay Protocol provides infrastructure for transferring and exchanging assets between blockchain networks. Its involvement was identified through the transaction route, not through an announcement by the service.\nMoving SOL into BTC would change the cryptocurrency held by the attacker while introducing another network into the transaction trail.\nWhether Relay can restrict the particular transactions, or whether the receiving Bitcoin addresses have been identified, was not established in the initial report.\nHacker previously converted $279M in stolen altcoins\nThe Solana transfers follow another batch of asset sales identified by Lookonchain earlier on November 1.\nIn a separate update, the analytics firm reported that the attacker had sold more than 130 altcoins across Ethereum-compatible networks.\nThose transactions returned approximately 123,400 ETH, valued at $277.26 million, alongside another 1.69 million USDC.\nThe combined proceeds amounted to nearly $279 million, according to the firm’s calculations.\nUnlike the latest SOL activity, those figures describe assets that the tracker reported receiving from earlier swaps.\nSome sales involved smaller cryptocurrencies with limited trading liquidity, where large orders can receive considerably less than the tokens’ quoted market value.\nOne transaction involving PROM illustrated the difficulty.\nLookonchain reported that the attacker sold 908,793 PROM tokens, valued near $5 million, through a Uniswap V2 liquidity pool.\nThe transaction reportedly returned just 0.0316 ETH, worth approximately $71 at the time.\nThe Ethereum transaction record provides the on-chain reference for the unusual swap.\nFBI links Binance attack to North Korea’s TraderTraitor\nThe latest conversions followed the FBI’s October 31 attribution of the Binance breach to North Korea.\nIn its official alert, the bureau identified the operation as TraderTraitor and said the attackers stole more than $6 billion in virtual assets.\nInvestigators said the group had been converting stolen cryptocurrencies primarily into Ethereum and expected further laundering through decentralized finance and instant-swap services.\nThe FBI, Secret Service and IRS Criminal Investigation called on exchanges, DeFi operators, blockchain infrastructure providers and analytics companies to block transactions connected to identified attacker-controlled addresses.\nAs crypto.news reported in its investigation, earlier asset freezes restricted billions in stolen cryptocurrencies while other holdings remained transferable.\nTether, Circle and other issuers were among the organizations that froze affected assets. The exchange reported approximately $3 billion frozen during its initial response.\nThe attack itself involved compromised wallet authorization controls, with blockchain security researchers examining Ethereum transactions that enabled unauthorized withdrawals.\nBinance has pledged to cover customer losses using company resources and emergency reserves.\nFollowing the breach, the exchange began restoring withdrawals on November 1, starting with Bitcoin before reopening selected stablecoin and other cryptocurrency networks.\nElsewhere, Binance said its Proof of Reserves address list now includes newly generated wallet addresses. Future customer withdrawals will be processed from those addresses as the company continues replacing affected assets and reviewing its security systems.\n\n\n\n\n\n                Read more:\n            \n\n                Why is Ethereum price up today as ETH targets $2,300 recovery?","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.1","shortVersion":"4.52.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2680201879","isCrawlerRequest":true}