Significant Moves of Stolen Crypto Following Binance Hack

On November 2, an individual transferred 80 million XRP, valued at around $100.9 million, from a wallet identified as related to the “Binance hack funds” to two distinct addresses. Concurrently, the hacker began converting stolen Solana into Bitcoin using the Relay platform. This development raises questions about multiple potential exit routes for the funds, although it does not confirm that the assets have been sold or successfully laundered.

What Transpired: Transfers from the Binance Hack Funds

Two XRP transactions made to different addresses are noteworthy.

• Two XRP Transactions: Whale Alert reported two transfers of 40 million XRP from the wallet labeled “Binance Hack 2026.” The first transaction occurred at 03:56 UTC on November 2, valued at approximately $50.46 million, while the second, completed 50 seconds earlier, was worth about $50.44 million. The recipients of these transactions remain unknown.
• Absence of Sale Confirmation: Whale Alert indicated that there were no signs of the XRP being deposited into an exchange or sold at that point. This is significant because simply moving funds between wallets does not confirm a sale has taken place.

Conversion of SOL into Bitcoin through Relay

The activities on Sunday were distinct. The attacker initiated the conversion of stolen Solana, approximately 970,522 tokens worth around $96 million, into Bitcoin via the Relay bridge. This operation was unrelated to the XRP transfers, and the reported transactions do not connect the XRP destinations to the Relay exchange route.

Furthermore, CoinDesk identified 18,270 stolen BTC, valued at approximately $78,076.00, distributed across 19 wallets. These bitcoins have remained inactive since Thursday, although the wallets have received minor transactions containing messages from unidentified individuals. These messages were sent as small Bitcoin transactions, each worth less than a dollar.

Connections to the Binance Hack Funds

The wallet labels indicate transactions but do not specify any individual’s identity.

• Link to Binance Hack: The label “Binance Hack 2026” links the sending wallet to the incident within the tracker records, but it doesn’t reveal who is managing the wallet. CoinDesk’s reporting attributes the bitcoin and Solana activities to the hacker, identifying the attacker as linked to North Korean operations, as indicated by the FBI.
• Tron Activity: According to The Defiant, analyst SomaXBT traced $140 million from the Binance breach through four Tron exit routes. The report did not detail individual transactions or recipients. The FBI’s request for blocking actions on October 31 included THORChain node operators but lacked specifics on which funds or operators were impacted.

Background of the October 29 Breach and Binance’s Response

Withdrawals were halted following the reported breach.

On October 29, Binance suffered a security breach leading to an estimated loss of $6.3 billion in cryptocurrency from hot wallets, necessitating a temporary suspension of withdrawals.

On November 1, Binance announced a gradual resumption of withdrawals, with the first phase set between 06:00 and 09:00 UTC that day, covering 15 networks, including XRP Ledger, Bitcoin, Ethereum, BNB Smart Chain, and Solana.

The exchange announced that most affected assets were restored.

By November 1, Binance had replenished nearly 95% of impacted assets, with the remaining 5% composed mainly of less liquid cryptocurrencies. Balances in major assets such as XRP and others were fully secured. The resumption of withdrawals for other networks would occur incrementally, dependent on security assessments.

Implications for Users and the Crypto Industry

The cross-chain activities complicate tracking of stolen assets.

The activities reported include XRP transfers, a conversion from SOL to BTC via Relay, and movements linked to Tron. Each transaction represents a unique action, emphasizing the complexity of tracking stolen cryptocurrency across various platforms and services. No single, clear path exists for the movement of all proceeds.

The attacker previously utilized THORChain to transfer stolen assets. Over that weekend, the service paused trading on 10 of its 13 chains, but it remains unclear whether this action impacted the XRP transfers or the RELAY conversion.

Binance customers underwent a structured restoration process post-breach.

The operational approach for customers involved a phased withdrawal restoration following the breach, with the November 1 schedule outlining 15 networks for the initial phase and others to follow based on security reviews. The remaining 5% of affected assets largely consisted of less liquid cryptocurrencies.

Key Figures: XRP, SOL, Bitcoin, and Tron

Transactions involving 80 million XRP spanned two separate transactions.

The two XRP transfers totaled 80 million tokens, valued at approximately $100.9 million. Each transaction comprised 40 million XRP directed to different recipients, with reported values of about $50.46 million and $50.44 million, respectively. This valuation pertains to the transfers and does not imply proceeds from a confirmed sale.

Approximately 970,522 SOL and 18,270 BTC were also noted.

The Sunday conversion involved 970,522 SOL valued at around $96 million, swapped into Bitcoin via Relay. Separately, 18,270 stolen BTC were housed across 19 wallets. These figures represent varied activities: one pertaining to a SOL to BTC conversion, and the other indicating BTC held within the wallets, which have remained static since Thursday.

The Tron figure represents an aggregated amount, not a detailed route.

SomaXBT’s analysis followed $140 million of stolen Binance funds through four Tron exit pathways. The overall findings indicated that assets on Tron remained unfrozen without a detailed transaction breakdown for each exit route.

Challenges in Interpreting Fund-Movement Reports

The primary risk lies in misinterpreting wallet transfers as evidence of a sale or laundered funds. The XRP tracking reports indicated transfers to two addresses but noted no additional signs of a sale or exchange deposit occurring at that time. The SOL conversion and Tron analysis are separate, not confirming that XRP followed those paths.

The Tron report provides an aggregated total and count of routes, lacking transaction-level specifics, which limits conclusions regarding recipients, transaction sequences, or connections to the XRP and SOL activity. The identifications made by the FBI are based on their records and conveyed through CoinDesk, but this does not suggest a named individual has been legally identified.

Future Steps for Binance and the Traced Funds

Binance’s withdrawal restoration process was staged.

The initial phase was scheduled for November 1, occurring between 06:00 and 09:00 UTC across 15 networks. The gradual resumption for other networks would unfold post-security evaluations, while the remaining 5% represented primarily less liquid crypto assets. Binance also reassured that their XRP and several major asset balances were fully secured, addressing customers’ concerns about the origins of the transfers from the linked wallets.

Recent wallet activities feature distinct timelines.

The SOL to BTC conversion on Sunday and the XRP transfers on November 2 are the latest observed activities. The mentioned 18,270 BTC held across 19 wallets have been inactive since Thursday, while the XRP moves remain directed to separate addresses as per tracking records. No documented follow-up transfers, exchange deposits, or other traceable actions have been reported concerning the XRP movements.

FAQs

• Which service facilitated the SOL to BTC conversion? The assailant utilized the Relay bridge to convert 970,522 SOL into Bitcoin, valued at approximately $96 million.
• How many wallets contained the stolen Bitcoin? An analysis identified 19 wallets storing 18,270 stolen BTC, which had not moved since Thursday.
• What assurance did Binance provide regarding affected customer balances? Binance confirmed that their balances in XRP, BTC, ETH, SOL, and BNB were fully backed and that around 95% of affected assets had been restored by November 1.
• What does the $140 million figure for Tron encompass? This figure relates to SomaXBT’s examination of Binance assets moving through four confirmed Tron exit routes, focusing on assets that remained unfrozen on the platform.
• Did the XRP transfers indicate that the funds were sold? No sales were reported in the tracking account; the 80 million XRP moved to two different addresses without evidence of an exchange deposit or sale at that time.
• What was Binance’s plan after the initial withdrawal phase? Binance stated that withdrawals on additional networks would commence gradually following security and infrastructure assessments. The first phase was set for November 1 across 15 networks.

This article is intended for informational purposes only and does not constitute financial advice.