Binance Hacker Is Swapping 970,522 SOL for Bitcoin: $95.9M, 3,000 Transfers, 1,000 Wallets — Why SOL's $90 Line Matters Now

The Binance hacker just changed tactics. On November 1, wallets linked to the $6.3 billion Binance theft began converting 970,522 SOL — worth about $95.9 million — into Bitcoin, according to blockchain analytics firms Chainalysis and Lookonchain. It is the second phase of the largest crypto laundering operation ever attempted, and it puts Solana's $90 support level directly in the blast radius.

This is not a routine wallet movement. The hackers have already scattered the loot across more than 1,000 wallets in over 3,000 transfers, and they are now deliberately hopping chains to break the trail. For SOL holders, the question is immediate: does a $95.9 million forced seller break $90? For Bitcoin holders, the question is stranger: does a thief buying Bitcoin help Bitcoin at all? The evidence says no — and the reasons matter for anyone holding either coin.

Here is what the on-chain trail actually shows, why the hackers prefer Bitcoin, what happens to the $2.4 billion-plus that has not moved yet, and the five checks every SOL and BTC holder should run this week.

What exactly happened: the laundering timeline

The October 29 Binance hack drained roughly $6.3 billion in crypto and stablecoins from the exchange's hot wallets — the largest crypto theft on record. The FBI has attributed the attack to TraderTraitor, a hacking group operating under North Korea's Reconnaissance General Bureau and linked to the Lazarus Group. Binance has since replaced most affected customer assets and gradually reopened withdrawals from November 1 — and customers have since pulled a net $4.72 billion from the exchange.

The laundering itself has unfolded in distinct phases, and recognizing the pattern is what separates panic from useful information:

Date	Phase	What happened
October 29, 2026	The theft	About $6.3 billion drained from Binance hot wallets; FBI later names TraderTraitor.
October 29–31	Phase 1: dispersal	Stolen funds moved into temporary wallets under hacker control and scattered across 1,000+ wallets in 3,000+ transfers.
November 1	Phase 2 begins	Lookonchain flags 486,970 SOL (about $46.4 million) moving in one hour; the full conversion program covers 970,522 SOL (about $95.9 million) into Bitcoin via Relay Protocol.
November 2	Phase 2 confirmed	Chainalysis publicly identifies a "new laundering phase" as hackers empty temporary wallets and route assets across chains.
Next	Phase 3 (expected)	Analysts expect the laundered Bitcoin to be broken into smaller amounts and converted into fiat currency — the cash-out stage.

One detail deserves emphasis: the 970,522 SOL figure is the size of the conversion program identified by analysts, not a single transaction. The first documented tranche was 486,970 SOL, and Elliptic separately traced roughly half of the stolen SOL holdings to a new address at about 09:38 UTC on November 1. The total amount of Bitcoin actually received from completed swaps remains unverified — a gap that matters, as explained below.

Why the hackers are swapping SOL for Bitcoin

Chainalysis gives two reasons, and both are about survival, not speculation. First, Bitcoin is harder to freeze. Stablecoins and many tokens can be frozen by their issuers — Tether alone froze $1.567 billion in 37 minutes after the Binance hack, as we covered in Can Tether Freeze Your USDT? Solana tokens routed through centralized services carry similar seizure risk. Bitcoin, held in self-custodied wallets, has no issuer to call and no freeze switch.

Second, Bitcoin is easier to cash out. It has the deepest liquidity, the most off-ramps, and the most established over-the-counter channels in the world. For a laundering operation whose end goal is fiat currency, Bitcoin is the funnel everything narrows into. That is why Chainalysis expects a third phase: after consolidation into Bitcoin, the funds get broken into smaller amounts and moved toward real-world currency.

The chain-hopping itself is the obfuscation layer. Moving stolen value from one chain to another, then into Bitcoin, forces investigators to stitch together separate transaction records. Cross-chain services like Relay record the source-chain deposit and the destination-chain fulfillment as separate events, so each hop adds a seam where the trail can go cold. Repeat that across 1,000 wallets and 3,000 transfers and you get the maze investigators are now mapping.

The 3,000-transfer maze: how investigators are still tracking it

Three thousand transfers sounds like invisibility. It is not. Every transfer is public, timestamped, and permanently recorded — which is exactly why strangers have been sending tiny Bitcoin payments containing personal pleas, ads, and scam links to the 19 wallets holding the hacker's 18,270 BTC, with one sender repeating "Help me bro." The attacker has not responded, but the episode proves the point: on a public blockchain, there is no such thing as a truly private wallet, only an untangled one.

Chainalysis and Elliptic are tracing the maze the same way detectives work any money trail: clustering wallets by shared behavior, timing, and counterparties, then watching for the moment laundered funds touch a regulated choke point — an exchange, a bridge, or a payment service that can freeze or identify them. That is also why the ecosystem's own defenses matter. The Arbitrum Security Council recently moved about $30 million in assets related to the Binance hacker without the attacker's private key, using a 9-of-12 signature emergency mechanism — a precedent we examined in Arbitrum Moved $30M Without the Hacker's Private Key. Freezes are possible where governance allows them, which is precisely why the hackers are racing toward the one asset with no governance to appeal to.

For ordinary holders, the lesson is uncomfortable but useful: the same transparency that lets anyone message a thief's wallet also lets anyone verify an exchange's claims, a project's treasury, or a whale's movements. Public chains cut both ways, and this week they are cutting in public.

What it means for Solana: the $90 line

Solana traded near $92 on November 3, fresh off a record 3.3 billion transactions on its network — strength that makes the hacker's selling especially awkward. A forced seller working through 970,522 SOL does not care about support levels, chart patterns, or network fundamentals. It sells because it must, and every tranche lands on the same side of the order book.

Analysts flagged $90 as the level that matters most, and the scenarios are stark:

Scenario	Trigger	Likely SOL outcome
Support holds	Buyer absorbs the remaining SOL tranches above $90	Forced selling exhausts itself; $90 becomes a proven floor and dip buyers gain confidence.
Support breaks	Conversion pace accelerates or market sentiment sours further	A break below $90 opens a fast move toward the low $80s, where the next cluster of buyers sits.
Selling stalls	Exchanges or bridges freeze identified routes mid-conversion	Pressure eases abruptly, but frozen-route headlines can spook the wider market first.

Context matters here. SOL is down sharply from its highs and the broader market is already fragile: Bitcoin ETFs lost $399 million on Monday alone, the Nasdaq 100 has entered correction territory, and the U.S. midterm results are landing overnight. A $95.9 million overhang does not need to be enormous to matter in that tape — it needs to be persistent and one-directional, and this one is both. Our guide to Solana Staking Explained is worth revisiting for holders weighing whether to stake through volatility rather than sell into it, and What Is a DEX? explains why decentralized venues — where no one can freeze your coins mid-swap — just hit a record 23% of spot trading after this very hack.

What it means for Bitcoin: no, a thief buying is not bullish

The most dangerous misreading of this story is also the most tempting: "the hacker is buying Bitcoin, so Bitcoin goes up." Analysts explicitly reject that logic. A conversion is not new demand in the economic sense — it is the same stolen value changing form. The SOL must be sold to buy the BTC, so the trade pushes one asset down to push the other up, and the net effect on crypto as a whole is roughly zero before fees, slippage, and panic are counted.

Three facts puncture the bullish case completely. First, the total Bitcoin received from completed swaps is unverified — analysts have documented the SOL side of the program, not a matching BTC receipt. Second, the hacker's existing 18,270 BTC across 19 wallets is itself an overhang: every coin the hacker consolidates is a coin that could later hit the market in phase 3. Third, the laundering headlines themselves are bearish for sentiment — they remind regulators, banks, and new investors of crypto's crime problem at the exact moment the industry is begging for the CLARITY Act and mainstream legitimacy.

Bitcoin traded near $77,600 on November 3, caught between ETF outflows, midterm uncertainty, and Friday's jobs report. The hacker's swaps are noise on top of those drivers, not a new driver. Anyone framing a thief's laundering as a buy signal is selling you something — most likely their own bags. For a calmer framework on moments like this, see Best Time to Buy Bitcoin in 2026 and Should I Buy the Bitcoin Dip?, and if you are buying at all, Cheapest Way to Buy Bitcoin in 2026 shows a $182 fee gap on a $10,000 purchase between platforms.

The $2.4 billion that has not moved — yet

Here is the number that should worry holders more than the $95.9 million already moving: as of November 2, Chainalysis reported limited onward movement in more than $1 billion in stolen ETH and $1.42 billion in stolen BTC. That is over $2.4 billion sitting still while the SOL tranche does the loud work.

Stillness is not safety. In phase 1, stillness meant dispersal — funds parked in temporary wallets while the hackers prepared routes. The SOL conversion proves the preparation is over for at least one tranche. The ETH and BTC tranches could follow the same playbook at any time, and ETH in particular faces the same freeze risk that pushed the hackers toward Bitcoin in the first place: much of the stolen ETH sits alongside freezable stablecoins and tokens.

The other side of the coin is enforcement. The Arbitrum intervention, Tether's freezes, and Binance's own replacement of customer assets show an ecosystem that now reacts in hours, not weeks. Every tranche the hackers move is a new set of addresses for investigators to cluster, sanction, and watch. The laundering race is genuinely two-sided — and phase 2 is the moment both sides are moving fastest.

Five checks for SOL and BTC holders this week

Use this checklist before making any move driven by laundering headlines:

• Check your exposure honestly: if SOL breaking $90 would force you to sell, decide your level now — not during a red candle driven by a thief's schedule.
• Check where your coins sit: coins on an exchange can be frozen, delayed, or withdrawal-gated during a crisis; self-custody removes that risk but puts key security entirely on you, as the post-hack exodus to self-custody showed in XRP's 7,934 New Wallets in One Day.
• Check the source of any "hacker buying" claim: if a post cannot show the BTC receipt side of a swap, it is a rumor — the SOL side alone proves selling, not buying.
• Check for copycat scams: laundering headlines breed fake "recovery" services, phishing bridges, and lookalike Relay sites; never connect a wallet from a link in a social post about the hack.
• Check your stablecoin assumptions: if you hold USDT or USDC as your "safe" asset, remember issuers can and do freeze funds — our Tether freeze explainer covers what that means in practice.

What happens next

Watch four things. First, the SOL tranche: whether the remaining conversion completes above $90 or accelerates through it. Second, the frozen-route risk: any announcement that a bridge or exchange blocked hacker-linked addresses would ease selling but could also trigger a volatility spike. Third, the silent tranches: fresh movement in the $1 billion-plus ETH or $1.42 billion BTC stacks would signal phase 2 widening. Fourth, phase 3 itself: smaller, faster Bitcoin movements toward off-ramps would mean cash-out has begun — and that is when investigators, not traders, become the main characters.

The $6.3 billion Binance hack will be traced for years. This week, it is a live market event: a $95.9 million forced seller in SOL, a myth about bullish thieves in BTC, and a $90 line that will tell us which side of the story the market believes first.

Frequently asked questions

How much SOL is the Binance hacker converting to Bitcoin?

Analysts identified a conversion program covering 970,522 SOL, worth about $95.9 million, being swapped into Bitcoin via Relay Protocol. The first documented tranche was 486,970 SOL, worth about $46.4 million, moved on November 1.

Who is behind the Binance hack?

The FBI attributed the October 29 hack, worth about $6.3 billion, to TraderTraitor, a hacking group operating under North Korea's Reconnaissance General Bureau and linked to the Lazarus Group.

Why are the hackers converting to Bitcoin instead of cashing out directly?

Bitcoin is harder to freeze than stablecoins or tokens with issuers, and it has the deepest liquidity and most off-ramps for eventual conversion to fiat. Chainalysis expects a later phase in which the Bitcoin is broken into smaller amounts and cashed out.

Is the hacker buying Bitcoin bullish for BTC?

No. A conversion sells SOL to buy BTC, so it is not new demand — and the total Bitcoin received from completed swaps remains unverified. The hacker's existing 18,270 BTC is itself a future selling overhang.

Will SOL break below $90 because of the hacker selling?

It might. Analysts flagged $90 as the key level while the forced selling continues. If buyers absorb the remaining tranches above $90, the level becomes a proven floor; if selling accelerates, a break opens a fast move toward the low $80s.

What happened to the rest of the stolen funds?

As of November 2, more than $1 billion in stolen ETH and $1.42 billion in stolen BTC showed limited onward movement. Binance replaced most affected customer assets, reopened withdrawals from November 1, and customers have since withdrawn a net $4.72 billion.

Conclusion

The Binance hacker's move into phase 2 is a masterclass in how crypto crime actually works: not a single dramatic theft, but thousands of quiet transfers, a chain-hop to break the trail, and a funnel into the one asset nobody can freeze. For SOL holders, the trade is concrete — a $95.9 million seller leaning on $90. For Bitcoin holders, the trade is psychological — resist the story that a thief's purchase is your green light. And for everyone else, the real signal is the $2.4 billion still sitting silent. When it moves, phase 2 becomes phase 3, and the market will hear about it first on-chain — exactly where this story started.

Sources: Chainalysis and Lookonchain via Korea JoongAng Daily, KuCoin Blog, WEEX market review, SBS News, The Bit Gazette, FN News, and CoinDesk. This article is for information only and is not financial advice.