An address linked to the hacker behind Binance's massive October 29 security breach has deposited stolen Solana into Privacy Cash, a privacy-focused mixer, marking a new phase in a laundering operation that has rapidly evolved and spread across 11 blockchains. The perpetrator has progressively rotated stolen assets through privacy tools and cross-chain infrastructure in an effort to obscure the connection between transactions.

Onchain Lens, an on-chain monitoring service, reported on November 3 that the hacker-linked address deposited 8,567 SOL, valued at roughly $798,000, into Privacy Cash, while multiple other related wallets showed similar activity.

The transfer adds a privacy-focused service to a laundering route that already includes decentralized exchanges, lending platforms, liquid staking, bridges and cross-chain swaps. As a result, investigators are tracking related wallet clusters and transaction patterns across networks rather than relying on activity from a single address.

BINANCE HACKER STARTS USING MIXER TO LAUNDER STOLEN FUNDS, MIXED 800K SO FAR ⚠️

An address linked to the hacker deposited 8,567 $SOL (~$798K) into Privacy Cash.

Multiple other addresses are showing similar activity. We are monitoring these movements in real time and working to trace and reconcile the full flow of funds.

@binance

— Onchain Lens (@OnchainLens) November 3, 2026

Post: Onchain Lens on X

Binance Hacker Adds Privacy Cash to Laundering Route

The Privacy Cash transfers mark the latest development in the ongoing disposal of assets stolen in the October 29 hack, which saw large amounts of digital assets taken from the exchange. Onchain Lens said it is tracking the activity in real time and working to connect the dots on the full flow of funds.

Cross-chain movements touching Ethereum, Tron, Solana, Bitcoin and other networks have occurred over the past few days as the stolen SOL is cycled through the system. Blockchain analytics firm Elliptic, which published an analysis of the laundering of the stolen funds, estimates that within the first three and a half days, the operation was conducted across approximately 12,000 wallets on 11 blockchains, producing more than 40,000 transactions.

SOL Is Being Split, Routed and Converted Into Bitcoin

Solana has become one of the active laundering routes in the aftermath of the theft. According to Elliptic, approximately 87,000 SOL, worth roughly $8 million, had left the original theft wallet by November 3. Those assets were distributed across new addresses, channeled into lending vaults and a liquid-staking service, and then offered or exchanged for Bitcoin.

In total, approximately 825,000 SOL was held across those addresses, with the majority concentrated in just two of them. The newly observed movement into Privacy Cash appears to be a measure intended to deepen the laundering of the misappropriated funds while breaking the visible connection between incoming and outgoing transactions.

Laundering Network Already Spans Thousands of Wallets

Most of the early laundering was carried out on Tron. The stolen TRX was spread across roughly 7,700 TRX addresses, and portions of its value were converted into Ethereum. At least $147 million has so far been withdrawn from Tron through various cross-chain bridges.

The attacker has also switched both the assets and the networks many times, repeatedly leveraging decentralized exchanges, lending platforms, and cross-chain swap services throughout the process. Bitcoin mixing began on November 1. By early November 2, approximately 28 BTC, worth around $2.2 million, had moved through a total of 18 CoinJoin transactions of the WabiSabi variety.

Elliptic said the activity conveys the impression of being highly automated, characterized by fixed transaction patterns, set amounts and the speed at which new wallets are generated. The rapid operation has resulted in approximately 32,000 transactions on Tron, with the highest activity occurring at a rate of 1,300 transactions per hour.

$3.18B in Stolen Crypto Still Remains Onchain

Regardless of the volume of funds already laundered, the bulk of the stolen cryptocurrency has not yet left on-chain addresses. As of November 3, Elliptic estimated that $3.18 billion remained in theft-connected addresses, most of it held in ETH and BTC. An additional $2.85 billion had already been frozen or seized.

Only minimal amounts have so far moved on to a cash-out channel, the firm said. That leaves centralized exchanges and OTC brokers as essential venues for intercepting and freezing the remaining stolen funds.

Source: Crypto Ninjas