Binance-linked hack wallets have resumed moving stolen funds across multiple chains, with on-chain trackers identifying two rapid XRP transfers and a large Solana-to-Bitcoin conversion. On November 2, 2026, a wallet associated with the Binance hack moved 80 million XRP in a single transfer, followed by another leg that brought the total moved to roughly $101 million across two transactions just 50 seconds apart. The destination addresses remained unidentified, and the activity resumed as Binance completed restoration of customer withdrawals.
In parallel, Lookonchain reported that the attackers moved 486,970 SOL worth approximately $46.4 million and began swapping the stolen Solana for Bitcoin through Relay Protocol. The broader Solana-linked outflow was put at 970,522 SOL, or about $95.9 million. The conversion into Bitcoin marks a shift in laundering tactics because native BTC lacks issuer-level freezing controls, although its transactions remain publicly traceable and cooperating exchanges or centralized services can still intercept identified funds.
SomaXBT estimated that around $242 million had actually left the attackers' temporary Tron holding wallets, warning that observed transfers near $500 million included repeated movements between addresses rather than fresh outflows. After a $6.3 billion breach, the attackers were said to still control roughly $3.5 billion overall. Cross-chain laundering has previously been seen in the Bitget and KelpDAO incidents via THORChain, and separate Lazarus-linked wallets moved $30 million through Hyperliquid and several blockchains. Investigators now face the challenge of intercepting remaining funds before further conversions disperse them across more networks and counterparties.
