A pile of violet coins with a thin stream of gold coins leaving it toward a closed vault and a barrier stopping part of the flow, while the rest of the pile stays untouched
Original AI-generated illustration.

Binance Hacker Swapped 11,136 SOL for 13.51 BTC Through Relay as the Service Began Blocking Its Wallets

NodeWitness Team 6 min read

The stolen Binance SOL did start flowing into bitcoin, but at a fraction of the reported scale. About 1% of the Solana loot reached BTC through Relay before the service began turning the attacker away, and that bitcoin has not moved.

The attacker behind the Binance hack swapped 11,136.2 SOL for 13.51 BTC, worth about $1.05 million, through cross-chain swap service Relay in 25 completed transactions on November 1, according to Relay's public API [7]. That is a small slice of the 970,522 SOL taken on October 29 [1][3].

Nearly half of the stolen SOL, 485,277 SOL, sits in a fresh address that has never spent a coin, according to our reading of the Solana chain [6]. Relay also rejected four of the attacker's requests as coming from blocked wallets [7].

The widely shared version was much larger. "The Binance hacker is swapping the stolen 970,522 $SOL ($95.9M) for $BTC. In the past hour, the hacker moved 486,970 $SOL ($46.4M) and is now swapping $SOL for $BTC through @RelayProtocol," on-chain tracker Lookonchain posted on X [1]. The post drew more than 110,000 views [1].

Half a million SOL, parked

The attacker's Solana address, AffzFDKZ, is on the FBI's list of addresses tied to the theft [4] and is attributed to the hack by Elliptic and Arkham [5][2]. Its first transaction is the theft itself, 965,455.1 SOL from a Binance hot wallet, followed by four transfers of 1,266.7 SOL each [6][8].

It sat idle until the morning of November 1 [6]. It then sent a 7 SOL test to a brand-new address, Eze86Ngj, followed seconds later by 485,270 SOL [6]. Eze86Ngj held 485,277 SOL in our November 2 reading and had never signed an outgoing transaction [6]. Tibane Labs, which runs its own tracker of the theft, reports the same [8].

That transfer accounts for nearly all of the one-hour movement Lookonchain flagged. Add the attacker's next two transfers to a second address, 838.4 SOL and 854.9 SOL, and the total is exactly Lookonchain's 486,970 SOL [1][6]. In other words, most of what was described as a bitcoin swap was a move to a wallet that has never touched Relay.

500 SOL at a time

The bitcoin route ran through that second address, 7SDuVQ2S, which received 18,573.5 SOL from the attacker in ten transfers over November 1 [6]. It sent out lots, mostly of 500 SOL, to fresh addresses, and each of those asked Relay to swap its SOL for bitcoin [6][7].

Relay's API lists each request with its Solana deposit, its bitcoin payout and the receiving address [7]. The 25 completed requests add up to 11,136.2 SOL in and 13.51 BTC out [7]. One of them is the swap in Lookonchain's screenshot, 299.95 SOL for 0.365 BTC [1][7].

Relay also pushed back. It rejected four requests, covering 1,799.7 SOL, with the failure reason BLOCKED_WALLET, and refunded a fifth, for 499.9 SOL, because the paying solver lacked funds [7]. The first rejection came around midday and the last three in the afternoon. No further requests from the attacker appear on Relay after those three [7].

Relay had already turned up in the trail. It handled about $48 million of the funds moved off Tron, according to analyst SomaXBT, as reported by The Block [10]. The FBI has asked instant exchanges and DeFi services to block transactions involving the theft addresses [4].

The bitcoin, unspent

On the bitcoin side, the money did not go far. Relay paid each swap to a single-use address, and within hours the attacker swept those payouts into seven fresh addresses [9]. The seven held 14.66 BTC, unspent, in our mempool.space reading on November 2, and an eighth address kept another 0.61 BTC [9].

15.27 BTC across eight addresses, with no outputs spent as of November 2 [9].

Not all of it came from Relay. Of the 15.27 BTC, 13.51 BTC was paid by the address Relay uses for its bitcoin payouts, exactly the total of its 25 completed swaps [7][9], and 1.76 BTC arrived in eight payments from another high-volume address we could not attribute [9]. Those payments match, in size and timing, 19 deposits carrying numeric memos that 7SDuVQ2S sent to a separate unlabeled Solana address, 2,961 SOL in total [6][9].

The bitcoin from the original theft has not moved either. The 19 outputs holding the 18,270.2 BTC taken from Binance's bitcoin hot wallet were all unspent in our November 2 check [9][8], as covered in our report on Binance reopening withdrawals.

A new route

On November 2, the attacker moved SOL again through a different channel. It sent 41,521.1 SOL to seven fresh addresses, four of which swapped 40,755.2 SOL for about 3.84 million USDC on Jupiter, Solana's swap aggregator, in five transactions [6]. The most recent, 5,684.9 SOL for 534,819 USDC, came more than an hour after the others [6]. The USDC was then sent on to other addresses we have not traced, within minutes in the latest case [6].

The original address still held 425,182.6 SOL, and 7SDuVQ2S held another 4,473.3 SOL [6]. With the 485,277 SOL parked in Eze86Ngj, more than nine in ten of the stolen SOL remain in the attacker's wallets without having passed through any service [6].

What the attacker does with that half-million SOL, and whether other services follow Relay's lead, remains to be seen. Any move from those wallets will show up on-chain, as will any move of the 15.27 BTC already on bitcoin.

We track the effect on the bitcoin market separately.

Sources

Source type in brackets. Times in UTC. Accessed November 2, 2026.

  1. Lookonchain, post on X, 10:35 UTC, November 1, 2026. 970,522 SOL, 486,970 SOL moved in one hour, Relay; Arkham screenshot of the 299.95 SOL swap. (Secondary, analyst)
  2. Arkham, AffzFDKZ address page, labeled "Binance Hacker", linked by Lookonchain. (Secondary, analytics)
  3. Arkham, thread on X about the theft, 04:20 UTC, October 30, 2026. 970,522 SOL stolen on Solana. (Secondary, analytics)
  4. FBI, North Korea Responsible for $6 Billion Binance Attack, October 31, 2026, with its address list, and post on X. (Primary, authority)
  5. Elliptic, Binance hack blocklist (CSV), downloaded November 2, 2026. Includes AffzFDKZ, Eze86Ngj, 7SDuVQ2S and the addresses that requested the swaps. (Secondary, analytics)
  6. Solana, our reading via the public RPC (api.mainnet-beta.solana.com) of AffzFDKZ, Eze86Ngj, 7SDuVQ2S and their destinations, around 09:18 UTC, November 2, 2026 (slot 464,442,227). (Primary, chain)
  7. Relay, our reading of its public requests API for each address funded by 7SDuVQ2S, around 09:20 UTC, November 2, 2026. Statuses, amounts, transactions and failure reasons. (Primary, service)
  8. Tibane Labs, Binance 14 signed away its own keys, live tracker of the theft, accessed November 2, 2026. (Secondary, research)
  9. mempool.space, our reading of Relay's payout addresses, the seven consolidation addresses (for example bc1q4kfm…rpf) and the 19 outputs from the original theft, at block 974,235 on November 2, 2026. (Primary, chain)
  10. The Block, North Korean hackers launder $242 million of Binance loot via Tron as FBI presses THORChain: analyst, November 1, 2026. (Secondary, press)

More in Price and market

See all 23 articles in Price and market →

Last updated: November 2, 2026