Binance hacker swaps stolen Solana for Bitcoin through Relay Protocol
An address labeled as the Binance hacker has begun converting tens of millions of dollars in stolen SOL into Bitcoin through cross-chain bridge Relay Protocol, following earlier reports that tens of millions in illicit funds crossed the platform within hours.
An address labeled as the Binance hacker is actively converting stolen Solana into Bitcoin using cross-chain bridge Relay Protocol, according to on-chain analytics platform Lookonchain. Lookonchain reported that the attacker is working through a stash of 970,522 SOL valued at roughly $95.9 million, having moved 486,970 SOL worth about $46.4 million within an hour to execute swaps into Bitcoin.[3][4][5][6]
Arkham Intelligence records shared by on-chain monitors show the hacker address received an inflow of 965,455 SOL worth $95.4 million from a Binance hot wallet two days earlier. Recent outbound transfers included 485,270 SOL valued at $46.23 million, alongside multiple smaller increments. Bridge data from Relay Protocol recorded a completed transaction on November 1, 2026, converting 299.95 SOL worth $28.61K into 0.36 BTC sent to a Bitcoin destination address. Analyst Crypto Patel separately reported that the hacker moved up to 497,730.326 SOL within one hour as part of a 981,282 SOL conversion effort.[1][5][6]
The transactions follow separate findings reported by on-chain analyst Specter, who stated that North Korean hackers routed approximately $38 million through Relay Protocol within seven hours. Specter argued that Relay Protocol failed to stop the transfers despite claiming to use Know Your Transaction monitoring, adding that such volumes could not have moved as quickly through THORChain. Crypto Patel noted the reported DPRK-linked transfers across wallet TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F, though noting that the transaction trail and alleged monitoring failures remained unverified.[2][7][8]
Key facts
- Lookonchain reported that the wallet labeled Binance_Hacker is swapping 970,522 stolen SOL, worth approximately $95.9 million, into Bitcoin via Relay Protocol.
- The hacker moved 486,970 SOL worth about $46.4 million within an hour, according to Lookonchain, while Crypto Patel reported 497,730.326 SOL moved in that timeframe.
- Arkham data shows the hacker wallet received 965,455 SOL worth $95.4 million from a Binance hot wallet two days earlier and later transferred 485,270 SOL worth $46.23 million.
- A Relay Protocol transaction completed at 10:12:58 UTC on November 1, 2026, bridged 299.95 SOL worth $28.61K into 0.36 BTC.
- On-chain analyst Specter reported that North Korean hackers routed roughly $38 million through Relay Protocol within seven hours.
- Specter stated that Relay Protocol failed to block the transfers despite claiming active Know Your Transaction compliance, though Crypto Patel noted the trail and alleged failure remained unverified.
Sources · 7 sources
- CP
Crypto Patel@CryptoPatelPost on X ·
BIG ALERT: BINANCE HACKER IS DUMPING $SOL TO BUY BITCOIN! The Binance hacker is swapping 981,282 $SOL worth $96.923Minto $BTC through @RelayProtocol. In just ONE HOUR: ➤ 497,730.326 $SOL moved ➤ $47.423M worth of SOL transferred ➤ Now actively swapping SOL for BTC. Is the hacker preparing to move the stolen funds into Bitcoin? Keep an eye on these on-chain movements. #Bitcoin #Solana #BinanceHack
Open source - CP
Crypto Patel@CryptoPatelPost on X ·
North Korean hackers reportedly moved $38M through Relay Protocol in just 7 hours. DPRK-linked hackers reportedly moved $38M through @RelayProtocol, raising serious questions about its KYT monitoring and cross-chain security. How did this happen? Wallet: TNhpfKq83wufEKGjBhQFnT7jnxYmyBzH6F The full transaction trail and alleged KYT failure remain unverified.
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨BINANCE HACKER SWAPPING STOLEN SOL FOR BITCOIN! The Binance hacker is converting the stolen 970,522 solana:So11111111111111111111111111111111111111112 (~$95.9M) into bitcoin:native, according to @lookonchain. In the past hour, the hacker moved 486,970 solana:So11111111111111111111111111111111111111112 (~$46.4M) and is now swapping solana:So11111111111111111111111111111111111111112 for bitcoin:native through @RelayProtocol.
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 LATEST: The Binance hacker is swapping stolen $SOL for $BTC through Relay Protocol after moving 486,970 $SOL worth $46.4 million in the past hour. https://t.co/piv8for6he
Open source - LO
Lookonchain@lookonchainPost on X ·
The Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC. In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol. https://t.co/2a9Oz59mn0 https://t.co/fSPdkstlxp
Open source - SI
Solid Intel 📡@solidintel_xPost on X ·
INTEL: Binance hacker swaps $46.4M in stolen SOL for Bitcoin through Relay Protocol The attacker moved 486,970 SOL in the past hour as part of a larger 970,522 SOL ($95.9M) position being converted into BTC. Data: Arkham https://t.co/VVSXepSXft
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
North Korean Hackers Moved $38M Through Relay Protocol in 7 Hours On-chain analyst Specter reported that North Korean hackers transferred approximately $38 million through Relay Protocol within seven hours, with transfers still ongoing at the time of the post. Despite Relay's claims of having a Know Your Transaction (KYT) monitoring system in place, it failed to block the transfers. Specter noted that North Korean hackers would have struggled to move such a large amount through THORChain in the same timeframe, raising questions about Relay's compliance and risk controls. Relay Protocol is a cross-chain bridge and interoperability protocol that enables asset transfers across multiple blockchains.
Open source - CB
Crypto BriefingArticle ·
North Korean hackers move $38M through Relay Protocol in 7 hours The incident highlights vulnerabilities in cross-chain protocols, potentially prompting stricter regulations and compliance scrutiny in the crypto sector. The post North Korean hackers move $38M through Relay Protocol in 7 hours appeared first on Crypto Briefing .
Open source