Binance Hacker Converts $279M in Stolen Altcoins to ETH, Moves $96M in SOL Toward Bitcoin

Published November 1, 2026, 6:20 PM PKT. Based on Lookonchain's November 1, 2026 on-chain updates as reported by crypto.news, TradingView, TokenPost and PANews. This is a follow-up to MABOnChain's November 1 articles on the FBI attribution and on withdrawals going live: where those articles covered blame and customer access, this article covers what the stolen funds themselves are doing now.

Wallets that on-chain tracker Lookonchain attributes to the Binance hacker converted about $279 million in stolen altcoins into ether and stablecoin on November 1, 2026, and separately began moving about $96 million in stolen Solana toward bitcoin, according to Lookonchain's updates as reported by crypto.news and TradingView. The activity is the largest single-day laundering wave reported since the October 29 theft of about $6.3 billion from Binance hot wallets, an attack the FBI said on October 31 was carried out by North Korea's TraderTraitor group. It also shows why the recovery story has two separate tracks that must not be confused: Binance says it has covered about 95 percent of customer losses with company money and reopened Phase One withdrawals on November 1, as MABOnChain reported earlier in the day, while the stolen coins themselves keep moving through exchanges and bridges that Binance does not control.

More than 130 altcoins sold for about $279 million in ETH and USDC

Lookonchain reported on November 1 that the attacker sold more than 130 altcoins across Ethereum-compatible blockchains, according to TradingView's report of the update, published November 1 at 08:13 UTC. The sales returned approximately 123,400 ETH, valued at about $277.26 million, alongside another 1.69 million USDC, TradingView reported, for a combined total of nearly $279 million. The tally covers only transactions confirmed on Ethereum-compatible chains, TradingView noted, so the overall total could change if sales on other blockchains are included. Crypto.news reported the same wave in the same terms, describing it as an earlier batch of asset sales identified by Lookonchain on November 1, before the Solana movement that followed. The sales fit the pattern the FBI warned about on October 31, when it said the TraderTraitor actors were converting stolen assets primarily into ether and were expected to launder them further through decentralized finance and instant swap services, a warning MABOnChain reported in its FBI attribution article. A separate Bitquery investigation published October 30, cited by Finbold, had already estimated the attacker incurred approximately $119 million in losses while liquidating stolen cryptocurrency, a reminder that converting billions in thinly traded tokens at speed destroys value even before any freeze or seizure.

SOL toward bitcoin: $46.4 million moved in one hour via Relay

The newer movement, reported by crypto.news on November 1, involves Solana. Lookonchain said the hacker is converting 970,522 stolen SOL, valued at $95.9 million, into bitcoin, crypto.news reported, and the attacker moved 486,970 SOL worth $46.4 million within one hour, with Relay Protocol identified as the swap route. Lookonchain linked the activity to a Solana wallet tracked by Arkham, crypto.news reported, and the address has been labeled as associated with the Binance hacker. Relay Protocol provides infrastructure for transferring and exchanging assets between blockchain networks, crypto.news noted, and its involvement was identified through the transaction route, not through an announcement by the service. At the time of the report, the 486,970 SOL movement represented roughly half the stolen SOL identified by Lookonchain, and the tracker described the operation as an ongoing conversion into bitcoin, although its initial update did not establish how much bitcoin had reached final receiving addresses, crypto.news reported. Moving SOL into bitcoin would change the cryptocurrency held by the attacker while introducing another network into the transaction trail, and whether Relay can restrict the particular transactions, or whether the receiving bitcoin addresses have been identified, was not established in the initial report.

The PROM swap: a quoted $5 million position became $71

One transaction in the same wave shows how illiquid the hacker's remaining altcoin pile is. Lookonchain reported that a wallet it attributes to the attacker sold 908,793 PROM tokens on Uniswap V2 but received just 0.0316 ETH, worth approximately $71 at the time, according to Finbold, TokenPost and PANews, all reporting Lookonchain's November 1 update. The $5 million figure reflects the tokens' estimated market value, not their realizable sale value, Finbold stressed, because the Uniswap V2 pool used for the sale was almost empty, so there was almost nothing on the other side of the trade. Crypto.news put the loss at almost 99.999 percent of the position's quoted value in a single swap, and TokenPost noted the same point in plain terms: the pool had almost no liquidity, leaving little available to take the other side of a sale of this size. The trade is not a $5 million loss of recovered money, since the tokens were stolen, and it is not evidence the attacker recovered anything. It is evidence that dumping a large position into a near-empty pool returns almost nothing, which is why the $279 million ETH total and the $5 million PROM quote measure different things: the first is what the tracker says was actually received, the second is what the tokens were quoted at before the swap.

What remains unconfirmed: attribution, final destinations, frozen totals

Three limits apply to everything in this article, and readers should hold them alongside the headline numbers. First, the wallet attribution comes from Lookonchain and an Arkham wallet label, as crypto.news reported, not from a Binance statement or a law-enforcement release naming these specific wallets, so the attribution is a tracker's finding, however widely carried. Second, the Solana conversion was reported as ongoing, with final bitcoin receipts not established, so the $95.9 million describes SOL identified for conversion, and the $46.4 million describes SOL moved within one hour, not bitcoin confirmed in the attacker's hands. Third, the frozen and located total, about $3 billion as of Friday according to Reuters reporting cited in MABOnChain's withdrawals article, is separate from both Binance's 95 percent customer coverage and the $279 million laundering wave: frozen assets are stolen coins stopped from moving, covered assets are replacement tokens Binance bought with company money, and converted assets are stolen coins that did move. The FBI, the US Secret Service and IRS Criminal Investigation have urged firms to block transactions linked to published TraderTraitor addresses, as MABOnChain reported October 31, but a blocklist only works where the service receiving the funds checks it, and the Relay route identified here shows the attacker is still finding paths that move value across chains. The next markers to watch are whether more of the 970,522 SOL reaches bitcoin, whether any service freezes the new bitcoin addresses, and whether Binance's promised full proof of reserves on November 3 changes the customer side of the story.

This article is news reporting and is not investment advice.

Sources

• Lookonchain, Binance hacker accidentally entered an empty liquidity pool while selling PROM, receiving just $71 for tokens valued at $5 million (November 1, 2026, primary source for the PROM trade figures: 908,793 PROM, 0.0316 ETH, about $71)
• crypto.news, Binance hacker moves $46M in stolen SOL for Bitcoin swaps via Relay (November 1, 2026, secondary source for the SOL conversion: 970,522 SOL at $95.9 million, 486,970 SOL at $46.4 million within one hour, Relay Protocol route, Arkham wallet label, and the $279 million altcoin wave)
• TradingView (Bloomingbit), Binance Hacker Sells More Than 130 Altcoins, Raises About $279 Million (November 1, 2026, secondary source for the altcoin wave: more than 130 altcoins, about 123,400 ETH at $277.26 million, 1.69 million USDC, EVM-only scope)
• TokenPost, Wallet Attributed to Binance Hacker Gets $71 for $5 Million in PROM (November 1, 2026, secondary source corroborating the PROM swap and the near-empty pool)
• PANews, Binance Attacker Loses About $5 Million in Botched Altcoin Dump (November 1, 2026, secondary source corroborating the PROM swap)
• MABOnChain, Binance Withdrawals Are Live Again for 15 Assets as Coverage Hits 95% (November 1, 2026, background source for the 95 percent customer coverage, the Phase One reopening, and the about $3 billion frozen or located figure)
• MABOnChain, FBI Blames North Korea for $6 Billion Binance Hack, Urges Firms to Block TraderTraitor Wallets (November 1, 2026, background source for the FBI TraderTraitor attribution and the address-blocking request)