Wallets associated with the massive Binance breach transferred 486,970 Solana tokens valued at $46.4 million within a single hour on November 1, according to blockchain tracking data. The tokens form part of a larger holding of 970,522 SOL, estimated at $95.9 million, that the attacker appears to be routing toward Bitcoin conversions.

The transfers used Relay Protocol, a service that facilitates asset exchanges across different blockchain networks. Roughly 483,600 SOL, worth about $46.14 million, remained at the linked address after the movement. Tracking showed the activity as an ongoing process rather than a completed set of final Bitcoin receipts.

Earlier Altcoin Liquidations Yield Nearly $279 Million

The Solana activity follows a prior wave of conversions involving more than 130 different altcoins. Those sales produced approximately 123,400 ETH valued at $277.26 million plus an additional 1.69 million USDC, for a combined total near $279 million.

Not every trade delivered strong returns. One transaction involving 908,793 PROM tokens, carrying a quoted market value near $5 million, returned only 0.0316 ETH, or about $71, when executed through a Uniswap V2 liquidity pool. Limited trading depth in smaller tokens can produce sharp discounts during large sales.

FBI Links Breach to North Korean Operation

The Federal Bureau of Investigation attributed the Binance incident to North Korea’s TraderTraitor group on October 31. The bureau stated that attackers stole more than $6 billion in virtual assets and had primarily converted holdings into Ethereum. Officials warned that further laundering would likely involve decentralized finance platforms and instant-swap services.

The FBI, Secret Service, and IRS Criminal Investigation jointly urged exchanges, DeFi operators, infrastructure providers, and analytics firms to block transactions connected to identified attacker-controlled addresses. Several issuers, including Tether and Circle, froze affected assets. Binance reported freezing roughly $3 billion in its initial response and stated that it had replaced nearly 95 percent of stolen customer funds.

Exchange Restores Services Amid Ongoing Monitoring

Binance began phased restoration of withdrawals on November 1, starting with Bitcoin and later expanding to selected stablecoins and other networks. The exchange confirmed that customer funds remained protected through company resources and emergency reserves. Newly generated wallet addresses were added to its Proof of Reserves list for future withdrawals.

Independent monitors, including Whale Alert, recorded a comparable transfer of 485,270 SOL valued at $46.35 million around the same time. Public records confirmed the wallet movements and engagement with the cross-chain protocol but did not show completed spot sales on centralized exchanges that would directly pressure Solana’s market price. SOL traded near $94.76 on November 1, down less than 1 percent over 24 hours, after an earlier 6.6 percent decline on October 29 that predated the latest transfers.

Authorities continue to track remaining holdings as the attacker shifts assets across networks. The conversion of Solana into Bitcoin adds another layer to the transaction trail while the broader effort to restrict stolen funds remains active.