Lookonchain Reports $46M SOL Movement Toward Bitcoin After Binance Theft
Lookonchain reported that wallets it linked to a Binance theft moved 486, 970 SOL, worth $46.4 million, along a route toward Bitcoin. The transfers do not confirm that the SOL was converted or show how much BTC, if any, reached final addresses.
- Lookonchain said the attacker controlled 970, 522 SOL worth $95.9 million.
- The reported route involved Relay Protocol, but Relay’s role and the outcome remain unconfirmed.
- Yahoo Finance reported that Binance temporarily suspended withdrawals, froze 44% of the stolen funds and pledged to cover customer losses.
- Claims about the FBI’s attribution and additional token sales need primary-source confirmation.
The on-chain figures Lookonchain reported point to a major movement, but not a confirmed Bitcoin conversion. According to the report, 486, 970 SOL moved within one hour. Lookonchain valued the amount at $46.4 million and said the attacker controlled 970, 522 SOL, then worth $95.9 million.
By token count, the reported movement amounted to about 50.2% of that SOL total. The dollar figures suggest a smaller share, about 48.4%. The available reporting does not give the valuation timestamps or explain the difference, so the token counts and dollar estimates should not be treated as directly comparable.
Lookonchain identified Relay Protocol in the transaction route and described the movement as an apparent attempt to swap SOL for BTC. That interpretation is not confirmation from Relay that an exchange took place. It also does not establish how much Bitcoin reached any final destination.
What is established about Binance’s response?
Yahoo Finance reported that Binance temporarily suspended customer withdrawals after the theft and said it would cover customer losses. The outlet also reported Binance’s claim that stablecoin issuers helped freeze 44% of the stolen funds.
The 44% figure and a separate estimate of roughly $3 billion are broadly compatible, but they are not the same figure. Forty-four percent of the reported $6.3 billion loss would be about $2.77 billion. The available account does not clarify the denominator, valuation time or what counted as “frozen, ” so this calculation does not confirm an exact recovery total.
The $6.3 billion figure is an estimate attributed to Binance, not an independently established loss total. The reporting available here does not explain how it was calculated. It confirms a temporary withdrawal suspension, but not the more detailed claim that withdrawals resumed on November 1 in a particular order.
Other reported sales show why token values can mislead
In a separate update dated November 1, Lookonchain reportedly said wallets linked to the attacker had sold more than 130 altcoins across Ethereum-compatible networks. The sales reportedly returned about 123, 400 ETH, valued at $277.26 million, and 1.69 million USDC.
Lookonchain also reportedly flagged the sale of 908, 793 PROM through a Uniswap V2 liquidity pool. The tokens were valued at nearly $5 million, but the reported trade returned 0.0316 ETH, worth about $71 at the time. The supplied reporting includes neither the transaction record nor the basis for the $5 million valuation, so those figures remain attributed claims.
The example still shows a basic market risk. A liquidity pool holds reserves that traders use to swap tokens. When a large sale hits a pool with shallow reserves, it can push the price down sharply as the trade executes. A quoted market value is not a guaranteed cash-out price. The market is not obliged to honor a portfolio screenshot.
Attribution and tracing are separate questions
Reports also attributed the Binance theft to North Korea’s TraderTraitor operation, citing the FBI. The supplied reporting does not include the agency notice needed to verify that attribution. An attribution tied to another theft, including the separate Bybit incident, is not evidence of responsibility for Binance.
The same distinction applies to wallet activity. Public blockchains show transfers, but identifying who controls an address, and proving that it belongs to a particular actor, requires separate evidence. Lookonchain’s links between wallets and an official government attribution are different kinds of claims.
Reports said the FBI, U.S. Secret Service and IRS Criminal Investigation urged crypto services to block transactions tied to identified addresses. They also said stablecoin issuers froze affected assets. Without the agency notice or issuer statements, the specific request, addresses and actions cannot be confirmed here.
Key questions and answers
-
How much SOL did Lookonchain say moved?
It reported that 486, 970 SOL, valued at $46.4 million, moved within one hour. Lookonchain also said the attacker controlled 970, 522 SOL, then valued at $95.9 million.
-
Was the SOL converted to Bitcoin?
The reported route suggested an attempt to move toward a SOL-to-BTC swap, but the available information does not confirm a completed conversion or the amount of BTC received.
-
What did Binance report freezing?
Yahoo Finance said Binance reported freezing 44% of the stolen funds. Compared with the separately reported $6.3 billion estimate, that would equal about $2.77 billion, but the basis and timing of the figures are unclear.
-
Did the FBI attribute the theft to TraderTraitor?
That attribution has been reported, but the agency notice needed to verify it is not available in the supplied reporting. A separate North Korea attribution does not establish responsibility for this incident.
-
Why can a token sale return far less than its quoted value?
A large trade against a low-liquidity pool can cause severe price impact. A position’s quoted value does not guarantee it can be sold at that price.
The reported SOL movement points to an attempted asset conversion, but does not prove where the funds ended up. The distinction matters: transaction traces can show movement, while completed swaps, final recipients and responsibility each require their own evidence. For related market context, see Bitcoin and SOL coverage. Binance’s support announcements also provide company-published updates.
