Binance Hack Proceeds Move Through Relay Into Bitcoin as Attacker Converts Solana Holdings
Blockchain trackers have followed wallets linked to the October 29 Binance hot wallet breach as they move roughly half of the traced 970,000 SOL, worth about $46 million, to new addresses. Lookonchain reports the attacker is swapping SOL for Bitcoin through Relay Protocol, while the FBI has attributed the theft to North Korea-linked TraderTraitor.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Half of the Traced Solana Moves in Two Transfers
A wallet linked to the October 29 Binance breach moved 485,270 SOL to an unknown address, according to Whale Alert, a figure Crypto Briefing values at about $46 million. A second tracker, Lookonchain, reported a separate movement of 486,970 SOL worth $46.4 million within a single hour and said the attacker was converting it into Bitcoin through Relay Protocol. Both reports describe the same roughly half of the Solana tied to the theft, but the sources differ on the exact amounts.
The two trackers also disagree on the size of the total Solana haul. Crypto Briefing cites analytics firms that traced about 970,500 SOL, worth around $96 million at the time of the hack. Lookonchain puts the figure at 970,522 SOL valued at $95.9 million. The totals are effectively the same, and the gap between the two movement figures is small, but the reports should not be treated as identical confirmations.
Bitcoin Conversion and Relay's Role
Lookonchain said the attacker is using Relay Protocol, an infrastructure provider for cross-chain transfers and swaps, to exchange SOL for BTC. The identification rests on the transaction route on-chain, not on any announcement from Relay. The initial report did not establish how much Bitcoin has reached final receiving addresses, and it did not say whether Relay could restrict these transactions.
Crypto Briefing describes the destination wallet as having no known owner and characterizes the movement as typical hop-and-obscure behavior. It does not mention the Bitcoin conversion, so the two accounts describe the next step of the flow differently. Neither source confirms a sale to fiat or an exchange deposit.
Earlier Conversions and Scale of the Theft
Before the Solana transfers, Lookonchain reported that the attacker had sold more than 130 altcoins across Ethereum-compatible networks for approximately 123,400 ETH, worth $277.26 million, plus 1.69 million USDC, for combined proceeds of nearly $279 million. Lookonchain also reported an illiquid sale of 908,793 PROM tokens, valued near $5 million, that returned only 0.0316 ETH, about $71. Liquidity-driven losses of this kind illustrate why quoted market values overstate what thin markets return.
The overall theft is reported at about $6.3 billion across roughly ten blockchains, which both sources cite. Crypto Briefing notes that around $3 billion was in stablecoins, much of which was frozen by issuers. The contrast between frozen stablecoins and unfrozen native assets such as SOL helps explain why attackers are moving non-stablecoin holdings.
Attribution and Response
The FBI attributed the breach to TraderTraitor, a North Korean state-linked group connected to the Lazarus Group, in an October 31 alert. The bureau said the attackers were converting stolen assets primarily into Ethereum and expected further laundering through decentralized finance and instant-swap services. The FBI, Secret Service and IRS Criminal Investigation asked exchanges, DeFi operators, infrastructure providers and analytics firms to block transactions linked to identified addresses.
Binance halted withdrawals at about 20:05 UTC on October 29 and began resuming them in phases from November 1. Crypto Briefing reports that Binance has committed to covering user losses through its Secure Asset Fund for Users, and that an estimated 90 to 95 percent of losses have already been covered through company reserves. Neither source reports recovery of the stolen assets themselves, which remain largely under attacker control.
Why It Matters
For Traders
Relay-routed SOL-to-BTC swaps mean the attacker's exit path may run through liquid markets, so watch for on-chain signs of sales that could pressure SOL.
For Investors
The breach and its laundering path underscore concentration risk in exchange hot wallets and the limits of issuer freezes for native assets like SOL and BTC.
For Builders
Cross-chain routers such as Relay are now part of the laundering trail, so bridge and swap providers should expect screening and blocklist requests tied to identified addresses.
This article is for information only and is not financial advice. Read the full disclaimer.
