The perpetrator of the largest cryptocurrency hack on record is actively liquidating stolen Solana. On-chain monitoring platforms report that 486,970 SOL — worth approximately $46.4 million — was moved within a single hour, part of a broader effort to convert nearly 970,000 SOL into Bitcoin through Relay Protocol.

The $46.4 Million SOL-to-Bitcoin Conversion

On-chain intelligence platform Arkham and monitoring service Lookonchain traced the movement to a larger operation converting 970,522 SOL, valued at roughly $95.9 million, into Bitcoin. Relay Protocol was identified as the cross-chain routing mechanism used to bridge the assets.

Of the total position, 486,970 SOL ($46.4 million) was moved during the reported hour, while approximately 483,600 SOL ($46.14 million) remained in the hacker's wallet at the time of reporting, according to Arkham data.

Phase Two of a $6.3 Billion Laundering Operation

The SOL-to-BTC conversion is not an isolated transaction. It represents a deliberate second phase following the theft of $6.01 billion from Binance hot wallets across nine chains between 20:10 and 23:05 UTC on October 29, 2026 — an attack Arkham confirmed as the largest crypto hack in history.

The attacker's original stablecoin holdings were largely neutralized when Tether, Circle, and Ripple froze a combined $2.80 billion in stolen assets, eliminating that portion of the haul as a usable exit route. The freeze was possible because major stablecoins include issuer-controlled blacklisting at the token-contract level, giving issuers a direct lever once flagged addresses are identified — a lever that does not exist for native assets like SOL or BTC.

With stablecoins frozen, the attacker pivoted to Solana holdings, now routing them through Relay Protocol into Bitcoin. Bitcoin's deeper liquidity — at a market capitalization of approximately $1.567 trillion — makes large inflows harder to detect and freeze than equivalent stablecoin movements.

SOL is currently trading at $95.28, meaning the full 970,522 SOL position represents sustained sell pressure on an already stressed market. The Fear and Greed Index sits at 34, firmly in “Fear” territory, following the October 29 attack.

The attack itself exploited EIP-7702 on Ethereum — a standard introduced in 2025 that lets ordinary externally owned wallets temporarily take on smart-contract capabilities such as transaction batching and delegated execution — which allowed the attacker to convert a Binance hot wallet into an attacker-controlled sweeper via 50 pre-signed authorizations, combined with access gained through a compromised DevOps engineer's laptop, according to technical reporting by The Block. The resulting liquidation cascade across the broader market underscored how interconnected exchange infrastructure risk is with DeFi protocols.

North Korean Attribution and What Remains at Risk

The FBI, Chainalysis, and TRM Labs have attributed the Binance hack to North Korea's TraderTraitor hacking unit with high confidence. TraderTraitor is a DPRK state-sponsored program that U.S. agencies have tracked in public advisories since 2022, known for intrusions targeting cryptocurrency exchanges and DeFi platforms. Chainalysis posted on X that investigators observed funds from the attack commingling with proceeds from the prior Bitget exploit, a pattern consistent with DPRK laundering methodology.

“Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance. We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.” — Chainalysis (@chainalysis) on X

TRM Labs estimates North Korea has stolen approximately $7.4 billion in cryptocurrency in 2026 alone, bringing the regime's total since 2017 to roughly $12.8 billion. The Binance attack follows a now-familiar playbook: exploit exchange signing infrastructure, drain funds across multiple chains simultaneously, and convert traceable bridged assets into Bitcoin before moving them to mixers.

Binance Response and Market Reaction

Binance co-CEO Richard Teng stated, “Your money is safe, and we're covering every loss,” and the exchange allocated $6.34 billion in reserves to cover losses. By November 1, Binance confirmed that 90% of stolen assets had been replenished.

The muted Bitcoin price response compared with historical exchange hacks reflects both the depth of current BTC liquidity and confidence in Binance's reserve position, with BTC trading at $77,922, up 0.70% on the day despite the attacker's active conversion.

Why the Movement Matters for On-Chain Tracking

Each asset conversion event is a trackable on-chain moment. When the attacker routes SOL through Relay Protocol into BTC, it creates a new wallet cluster that blockchain forensics firms can link to the original Binance exploit addresses, extending the investigative trail.

The absence of published transaction hashes for the specific 486,970 SOL movement limits independent verification at this stage. Arkham and Lookonchain are the cited monitoring sources, but raw on-chain explorer data has not been published in available reporting.

The FBI has urged private-sector entities to block transactions from identified hacker addresses, and the broader DeFi ecosystem has responded by tightening collateral parameters on assets exposed to the hack. With approximately $2.9 billion in ETH, BTC, TRX, SOL, and altcoins confirmed by Arkham as still movable, the active conversion phase is likely to continue as investigators race to map and flag new wallet addresses before funds reach mixers or over-the-counter desks. For anyone tracking the laundering in real time, the clearest markers are movement of the remaining 483,600 SOL balance, additional freeze actions tied to newly identified addresses, and fresh wallet-cluster attributions connecting new movements back to the October 29 exploit.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.