On Nov. 2, somebody moved 80 million XRP▼$1.25 value about $100.9 million from a pockets labeled “Binance hack funds” to 2 separate addresses. On the similar time, the attacker was changing stolen Solana to bitcoin by means of Relay—a transfer that places a number of potential exit routes again into focus, although none of this proves the funds have truly been offered or efficiently laundered.
Contents
What Occurred: Binance Hack Funds Moved in XRP and SOL
Two XRP transfers went to separate addresses
Whale Alert flagged two transfers of 40 million XRP every from the pockets tagged “Binance Hack 2026.” One transaction, value about $50.46 million, occurred at 03:56 UTC on Nov. 2; the opposite occurred 50 seconds earlier and was valued at about $50.44 million. Each went to separate addresses whose homeowners stay unidentified.
The monitoring service famous it noticed no signal of the XRP reaching an alternate or being offered at the moment. That distinction issues: transferring funds between wallets isn’t itself proof of a sale.
SOL moved into bitcoin by means of Relay
Sunday’s exercise was separate. The attacker started changing stolen SOL▼$93.95—970,522 tokens value about $96 million—into bitcoin by means of the Relay bridge. This occurred independently of the XRP transfers, and the reporting doesn’t join the XRP locations to the Relay route.
Individually, CoinDesk counted 18,270 stolen BTC▼$77,683.00 sitting throughout 19 wallets. None of that bitcoin has moved since Thursday, although the addresses have been receiving small funds carrying messages from strangers.
These messages arrived as tiny bitcoin transactions, every value lower than a greenback. One sender paid 1,000 satoshis to every of the 19 wallets at 11:43 UTC and once more at 16:03 UTC on Friday, then despatched 1,111 satoshis to every early Sunday morning—spending about $46 in bitcoin, plus charges, throughout three rounds. Different messages promoted a THORChain swap website, urged the hacker to not return funds to CZ, discouraged a white-hat deal, peddled a token, and requested for “Satoshis for treats.” None drew a response.
Who Is Linked to the Binance Hack Funds?
Pockets labels determine the transfers, not an individual
The “Binance Hack 2026” label hyperlinks the sending pockets to the incident in the tracker’s information. It doesn’t determine the particular person controlling it. The bitcoin and Solana actions had been attributed to the attacker in CoinDesk’s reporting, which additionally famous that the FBI’s account identifies the attacker as working for North Korea—an attribution to the FBI, not a courtroom discovering figuring out a named particular person.
Tron exercise is described at a excessive stage
The Defiant reported that analyst SomaXBT traced $140 million in Binance loot by means of 4 Tron exit routes, with the evaluation targeted on property left unfrozen on Tron. The report doesn’t present transaction-by-transaction particulars or determine recipients. The FBI’s Oct. 31 blocking request explicitly included THORChain node operators and downstream funds, although no additional specifics about which funds or operators had been lined seem in the obtainable account.
Background: The Oct. 29 Breach and Binance’s Response
Withdrawals had been paused after the reported loss
Binance confronted a safety breach on Oct. 29 that resulted in an estimated $6.3 billion in cryptocurrency losses from sizzling wallets. The alternate briefly paused withdrawals.
On Nov. 1, Binance introduced a phased restart. The primary withdrawal-restoration stage was scheduled for 06:00 to 09:00 UTC that day and included 15 networks: XRP Ledger, Bitcoin, Ethereum, BNB▼$703.41 Sensible Chain and Solana amongst them.
Binance stated most affected property had been replenished
By Nov. 1, the alternate had replenished about 95% of affected property. The remaining 5% consisted primarily of much less liquid cryptocurrencies. Balances in XRP and a number of different main property—BTC, ETH▲$2,281.32, SOL and BNB—had been absolutely backed. Withdrawals on different networks would resume steadily after safety and infrastructure checks, following a staged course of moderately than a single restart for each community.
Why the Reported Routes Matter to Customers and the Business
Cross-chain motion complicates fund monitoring
The reported exercise spans XRP transfers, a SOL-to-BTC swap by means of Relay and funds related to Tron. Every represents a definite motion, and collectively they present why monitoring stolen property requires monitoring a number of networks and providers. The obtainable descriptions don’t doc one steady path for all proceeds.
THORChain had already been utilized by the attacker to maneuver stolen funds. Over the weekend, the service halted buying and selling on 10 of its 13 chains, although the report doesn’t state this halt brought on both the XRP transfers or the Relay swap.
Binance clients confronted a phased restoration
For purchasers, the operational actuality was a staged return of withdrawals after the breach. The Nov. 1 schedule outlined 15 networks for the primary part and different networks to comply with as soon as checks had been full. The situation for later phases was clear: safety and infrastructure opinions. Binance’s separate replenishment replace defined that the excellent share was primarily much less liquid property.
The Numbers: XRP, SOL, Bitcoin and Tron
80 million XRP moved in two transactions
The 2 XRP transfers totaled 80 million tokens and had been valued at roughly $100.9 million. Every transaction concerned 40 million XRP to a special vacation spot, with reported values of roughly $50.46 million and $50.44 million respectively. The overall describes the worth attributed to the transfers, not proceeds from a confirmed sale.
970,522 SOL and 18,270 BTC had been additionally cited
The Sunday conversion concerned 970,522 SOL valued at about $96 million, which the attacker started swapping into bitcoin by means of Relay. Individually, 18,270 stolen BTC had been held throughout 19 wallets. These figures describe totally different property and exercise: one is a reported SOL-to-BTC swap, whereas the opposite is a depend of BTC held throughout wallets. The BTC has not moved since Thursday.
The Tron determine is an combination, not a route map
SomaXBT’s evaluation traced $140 million in Binance loot by means of 4 Tron exit routes. The obtainable description says property remained unfrozen on Tron however doesn’t present transaction values for every route or an in depth sequence of transfers. The dimensions of the preliminary incident was estimated at round $6.3 billion. Binance stated about 95% of affected property had been replenished by Nov. 1; these figures put the reported restoration in context with out displaying the result of every particular person motion.
Dangers in Studying the Fund-Tracing Stories
The principle threat is treating a pockets switch as proof of a sale or accomplished laundering route. The XRP monitoring account described transfers to 2 addresses and stated it noticed no signal of an alternate deposit or sale at the moment. The reported SOL conversion and Tron evaluation are separate gadgets, not proof that the XRP adopted both path.
The Tron account provides an combination quantity and a depend of routes however no route-level particulars, limiting what may be stated about recipients, transaction sequence or whether or not the 4 routes hook up with the XRP and SOL actions. The attacker’s id is offered as an FBI attribution relayed by CoinDesk, whereas the pockets label is a monitoring designation. Neither ought to turn into a declare {that a} named particular person has been convicted.
What Occurs Subsequent for Binance and the Traced Funds
Binance’s withdrawal restoration was staged
The primary part was scheduled for Nov. 1 between 06:00 and 09:00 UTC on 15 networks. Restoration on different networks would proceed steadily after safety and infrastructure checks, with the remaining 5% of affected property consisting primarily of much less liquid cryptocurrencies. Binance additionally stated XRP and a number of different major-asset balances had been absolutely backed—addressing buyer balances, not the vacation spot of the transfers from the hack-linked pockets.
The reported pockets exercise has separate timelines
The Sunday SOL-to-BTC swap and the Nov. 2 XRP transfers are the most recent actions described. The 18,270 BTC throughout 19 wallets has not moved since Thursday, whereas the XRP locations stay separate addresses in the monitoring report. No documented follow-on switch, alternate deposit or different traceable motion has been reported for these XRP transfers.
FAQ
Which service dealt with the reported SOL-to-BTC swap?
The attacker used the Relay bridge for the reported conversion of 970,522 SOL into bitcoin, valued at about $96 million.
What number of wallets held the reported stolen bitcoin?
The evaluation counted 19 wallets holding 18,270 stolen BTC. These cash had not moved since Thursday on the time of the account.
What did Binance say about affected buyer balances?
Binance stated XRP, BTC, ETH, SOL and BNB balances had been absolutely backed. It additionally stated round 95% of affected property had been replenished by Nov. 1.
What does the reported $140 million Tron determine cowl?
It refers to SomaXBT’s evaluation of Binance loot transferring by means of 4 Tron exit routes, as summarized by The Defiant. The abstract says the main focus was property left unfrozen on Tron, with out a transaction-by-transaction breakdown.
Did the XRP transfers set up that the funds had been offered?
No sale was described in the monitoring account. It stated the 80 million XRP went to 2 separate addresses and that it noticed no signal of an alternate deposit or sale on the time.
What did Binance say would occur after the primary withdrawal part?
Binance stated withdrawals on different networks would resume steadily after safety and infrastructure checks. The primary part had been scheduled for Nov. 1 on 15 networks.
This text is for info solely and isn’t monetary recommendation.
