The attacker behind the largest crypto hack in history is actively liquidating stolen Solana, with on-chain monitoring platforms reporting that 486,970 SOL, worth roughly $46.4 million, was moved in a single hour as part of a broader conversion of nearly 970,000 SOL into Bitcoin through Relay Protocol.
What Happened in the $46.4M SOL-to-Bitcoin Swap
On-chain intelligence platform Arkham and monitoring service Lookonchain identified the movement as part of a larger operation converting 970,522 SOL, valued at approximately $95.9 million, into Bitcoin. Relay Protocol was identified as the cross-chain routing mechanism used to bridge the assets. For related coverage, see Kim Jong Un Memes Flood X After Binance’s $6.3B Hack.
Of the total position, 486,970 SOL (~$46.4M) was moved in the reported hour, with approximately 483,600 SOL (~$46.14M) remaining in the hacker’s wallet at the time of reporting, per Arkham data.
Phase 2 of a $6.3B Laundering Operation
The SOL-to-BTC conversion is not an isolated event. It represents a deliberate second phase following the theft of $6.01 billion from Binance hot wallets across nine chains between 20:10 and 23:05 UTC on October 29, 2026, an attack Arkham confirmed as the largest crypto hack in history. The attacker’s original stablecoin holdings were largely neutralized when Tether, Circle, and Ripple froze a combined $2.80 billion in stolen assets, eliminating that portion of the haul as a usable exit route.
With stablecoins frozen, the attacker pivoted to Solana holdings, now routing them through Relay Protocol into Bitcoin. BTC’s deeper liquidity, at a market cap of approximately $1.567 trillion, makes large inflows harder to detect and freeze than equivalent stablecoin movements. SOL is currently trading at $95.28, meaning the full 970,522 SOL position represents sustained sell pressure on an already stressed market. The Fear and Greed Index sits at 34, firmly in “Fear” territory, following the October 29 attack.
The attack itself exploited EIP-7702 on Ethereum, which allowed the attacker to convert a Binance hot wallet into an attacker-controlled sweeper via 50 pre-signed authorizations, combined with access gained through a compromised DevOps engineer’s laptop, according to technical reporting by The Block. The resulting liquidation cascade across the broader market underscored how interconnected exchange infrastructure risk is with DeFi protocols.
North Korean Attribution and What Remains at Risk
The FBI, Chainalysis, and TRM Labs have attributed the Binance hack to North Korea’s TraderTraitor hacking unit with high confidence. Chainalysis posted on X that investigators observed funds from the attack commingling with proceeds from the prior Bitget exploit, a pattern consistent with DPRK laundering methodology.
“Our investigators observed funds stolen by DPRK in last month’s Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.”
— Chainalysis (@chainalysis) on X
TRM Labs estimates North Korea has stolen approximately $7.4 billion in crypto in 2026 alone, bringing the regime’s total since 2017 to roughly $12.8 billion. The Binance attack follows a now-familiar playbook: exploit exchange signing infrastructure, drain across multiple chains simultaneously, and convert traceable bridged assets into Bitcoin before moving to mixers.
Binance co-CEO Richard Teng stated “Your money is safe, and we’re covering every loss,” and the exchange allocated $6.34 billion in reserves to cover losses. By November 1, Binance confirmed 90% of stolen assets had been replenished. The muted Bitcoin price response compared to historical exchange hacks reflects both the depth of current BTC liquidity and confidence in Binance’s reserve position, with BTC trading at $77,922, up 0.70% on the day despite the attacker’s active conversion.
Why the Movement Matters for On-Chain Tracking
Each asset conversion event is a trackable on-chain moment. When the attacker routes SOL through Relay Protocol into BTC, it creates a new wallet cluster that blockchain forensics firms can link to the original Binance exploit addresses, extending the investigative trail. The absence of published transaction hashes for the specific 486,970 SOL movement limits independent verification at this stage; Arkham and Lookonchain are the cited monitoring sources, but raw on-chain explorer data has not been published in available reporting.
The FBI has urged private-sector entities to block transactions from identified hacker addresses, and the broader DeFi ecosystem has responded by tightening collateral parameters on assets exposed to the hack. The remaining approximately $2.9 billion in ETH, BTC, TRX, SOL, and altcoins confirmed as still movable by Arkham means the active conversion phase is likely to continue as investigators race to map and flag new wallet addresses before funds reach mixers or over-the-counter desks.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
