Roughly half of the Solana tokens tied to the record-breaking October breach have been shifted to a fresh address, Whale Alert flagged
A wallet holding stolen funds from the 2026 Binance hack just moved 485,270 SOL, valued at $46 million, to an unknown address. The transfer was flagged by blockchain tracking service Whale Alert.
What the transfer tells us
Blockchain analytics firms have traced about 970,500 SOL, the native token of the Solana network, to the initial breach. At the time of the hack, that stash was valued at around $96 million.
The newly moved batch represents approximately half of that total. So the attackers have now repositioned roughly half of their Solana haul in a single transfer.
The math holds one small detail worth noticing. Half of $96 million would be about $48 million, yet this batch is valued at $46 million, which means the dollar value per token has slipped a bit since the theft.
The destination wallet has no known owner. That is typical of how stolen crypto travels: hop to a fresh address, then another, ideally until the trail goes cold.
A breach of historic scale
The broader incident dwarfs this single move. The October 29, 2026, attack on Binance’s hot wallets saw approximately $6.3 billion stolen, making it the largest digital asset theft in history.
Hot wallets are the internet-connected wallets exchanges use to process day-to-day withdrawals. They are convenient by design, which also makes them the most exposed part of an exchange’s setup.
The losses spread across roughly 10 blockchains. Ethereum, Bitcoin and SOL all took significant hits.
Stablecoins made up a large chunk of the damage, with around $3 billion taken. Much of that stablecoin total was frozen, since issuers of dollar-pegged tokens can often lock specific addresses.
That freezing power is a key difference between asset types. A stablecoin issuer can effectively hit pause on stolen tokens, while native assets like SOL, Bitcoin and ETH have no central party able to do the same.
Which helps explain why SOL is the asset in motion here. Attackers tend to keep moving the funds that nobody can lock down.
Who is behind it
The FBI has attributed the breach to TraderTraitor, a North Korean state-linked hacking group. The group is connected to the Lazarus Group and to hacking strategies seen in previous attacks.
Binance halted withdrawals on October 29, 2026, at around 20:05 UTC. The exchange began resuming withdrawals in phases starting November 1, 2026.
On the user side, Binance has committed to covering all losses through its Secure Asset Fund for Users, better known as SAFU. The fund is a reserve the exchange set aside specifically for emergencies like this one.
Estimates indicate that 90-95% of the losses have already been covered through company reserves. Still, the majority of the stolen assets themselves remain under the attackers’ control.
Those are two separate ledgers. Customers are being made whole by Binance, but the hackers have not given anything back.
What this means for the market
For SOL holders, the immediate question is whether this batch eventually hits the market. A sale of 485,270 SOL through exchanges or swap services could add selling pressure, though nothing in the transfer itself confirms a sale is coming.
Laundering usually involves converting assets into something harder to trace. Any route through Solana-based decentralized exchanges, bridges or over-the-counter desks would leave on-chain footprints that trackers are watching closely.
For centralized exchanges, the stakes are bigger than one token. A breach of this size could push some users toward self-custody and cold storage, or toward decentralized finance alternatives where they hold their own keys.
What to watch next: whether the remaining roughly half of the traced SOL follows this batch, whether any of the funds reach exchanges that can freeze them, and whether law enforcement announces seizures.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.
