CryptoGuardzIndependent crypto register
Read the binding document, check it against the issuing register, publish the disagreement18+ · Gambling carries risk of loss

Choose a language

The register is published in these languages. If this page has no version in one of them, you go to that language’s home page.

Open combination padlock on a computer keyboard
News · Security and scams

Binance hacker 2026: where the stolen billions are now, as $46 million in SOL moves

At 09:39 UTC on 1 November 2026 a wallet labelled Binance Hack 2026 by Whale Alert sent 485,270 SOL to a new address. On Ethereum, 197,460 ETH still sat untouched in the same address as on 30 October.

Published By the CryptoGuardz Register Desk3 min read10 sources
Photo: Sasun Bughdaryan / Unsplash

At 09:39 UTC on 1 November 2026, a Solana wallet tracked as the Binance hacker's sent 485,270 SOL, worth about $46.4 million at the time, per Whale Alert, to a new address, three days after the 29 October theft that Binance puts at about $6.3 billion. On Ethereum, the biggest pile has not moved since at least 30 October.

What the blockchain shows

The Solana transfer can be read directly from the chain. Sender AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU, labelled "Binance Hack 2026" by Whale Alert and linked to the hacker by Arkham according to crypto.news, paid 485,270 SOL to Eze86Ngj2Ue4xKBbTHgXbhm22xnVF4aTxKrhUuVNDrrD at 09:39:08 UTC. When this brief checked both balances around 14:00 UTC, the sender still held about 470,276 SOL and the new address held about 485,277 SOL. That is about 955,553 SOL across the two. The sender had sent out roughly 15,000 more SOL since 09:39 and was still active.

The on-chain tracker Lookonchain said on X that the hacker holds about 970,522 SOL and was swapping it for Bitcoin through Relay Protocol, as reported by crypto.news. The sender held 970,547 SOL just before the 09:39 transfer. At the time of checking, the 485,270 SOL had not left the receiving address, so the swap claim is not confirmed for that batch.

On Ethereum, address 0x8532fa14acaf483729c449b8458aeddb900543d4 held 197,460 ETH on 1 November. Only dust deposits had arrived since the 30 October trace.

How the rest is moving

Elliptic, writing on 31 October, counted $6.43 billion stolen across 11 blockchains and $2.84 billion verified as frozen, about 44%. It found that the main Tron distribution wallet had sent about $93.5 million to around 150 wallets, and had sent funds every hour for 31 hours straight. Its verdict on the pattern:

The Binance funds are being moved by something that does not sleep.

Elliptic, The Binance hack is laundering on autopilot, retrieved 2026-11-01

Elliptic traced $25 million into THORChain, $5.3 million into SunSwap and $1.8 million into Bitget Swap from the main distribution wallets. Chainalysis says Binance funds have mixed on-chain with funds from the Bitget theft a month earlier, which had previously been attributed to North Korean actors.

Two claims went viral on X and are not verified here. One says the attacker parked USDT on Aave and borrowed ETH against it before the stablecoin freezes landed; the published figures conflict and no transaction was checked. The other, a post attributed to Chainalysis, says an Ethereum reorg made THORChain pause and delayed part of the laundering; the post was not reachable for this brief.

What it changes for users

For Binance customers, nothing directly: in its fourth recovery update Binance says it has covered about 95% of the impacted amount. For everyone else, frozen stablecoins stay frozen only where the issuer can freeze them. ETH, SOL and BTC cannot be frozen at the protocol level, and trackers report the attacker converting into them. The FBI said on 31 October that it had seen TraderTraitor actors "converting stolen assets", mainly into Ethereum, according to TheStreet.

Quick answers

Where is the Binance hack money now?

Stolen across 11 blockchains, per Elliptic. On 1 November one Ethereum address still held 197,460 ETH and two Solana addresses held about 955,553 SOL.

Is the Binance hacker selling?

No cash-out has been shown on-chain here. Trackers report altcoins sold for ETH and SOL routed toward Bitcoin. The 1 November SOL batch had not left its new address when checked.

Can the stolen crypto be frozen?

Only tokens whose issuer can freeze them, such as USDT and USDC. Elliptic counted $2.84 billion frozen by 31 October.

Latest news on this topic

Binance hack 2026: who froze the stolen money, from Tether's 1.77 billion USDT to ArbitrumTRM Labs counted about $2.7 billion of the 29 October Binance theft frozen by 00:30 UTC on 30 October, most of it by Tether and Circle, with Ripple, World Liberty Financial and the Arbitrum Security Council adding the rest. Binance, Elliptic and on-chain investigators have each published a different total.Binance withdrawals 2026: phase one reopens on 15 networks after the $6.3 billion hackBinance scheduled the first phase of withdrawals for 06:00 to 09:00 UTC on 1 November 2026, covering 15 networks, and says it has now covered about 95% of the amount taken in the 29 October theft. Other networks and tokens have no date yet.Binance hack 2026: what the blockchain shows about the $6.3 billion theftBinance says about $6.3 billion was taken from its hot wallets on 29 October 2026 and about $3 billion has been frozen. On Ethereum, a single transaction emptied the hot wallet labelled Binance 14 into an attacker address, and 197,460 ETH was still sitting untouched in a second address on 30 October.

All news briefs

More analysis

Tampered Ledger wallets 2026: Singapore police link malicious components to losses of about 3.5 millionThe Singapore Police Force said on 28 October 2026 that preliminary investigations found malicious components, able to capture recovery phrases, in Ledger hardware wallets bought from some local retail stores, with at least two cases and losses of about 3.5 million since 10 September. It follows Ledger's own October findings about devices sold by the reseller CryptoBilis.OFAC sanctions North Korea IT worker network in 2026 and lists 8 crypto addresses Tether has frozenOn 28 October 2026 OFAC sanctioned 10 people and one entity tied to North Korea's IT worker schemes and listed 8 Ethereum and Tron addresses. The USDT contract records freezes on all 8, seven of them on 28 October.Polymarket hack 2026: how a compromised vendor script drained traders on 29 OctoberPolymarket says one of its third-party providers was compromised on 29 October 2026 and that everyone affected will be made whole. The provider named in research and by its own warning is DebugBear, whose monitoring script carried wallet-draining code; about $2.65 million in POL was traced to one wallet.Electrum 4.8.3 patches a high-severity flaw that let malicious servers trick users into paying attackers in October 2026On 24 October 2026 Electrum released version 4.8.3 and disclosed a high-severity flaw that let a malicious server swap a user's fresh payment for a fake one paying the attacker. The developers say some servers are using it in the wild and that one of two reporting users lost money.Duelbits hack 2026: what the blockchain shows about the missing $7 millionThe Ethereum address that collected most of the Duelbits hot-wallet theft received about 2,334 ETH on 24 and 25 September 2026 and held 973.5 ETH on 28 September. The operator's promise that user funds are safe was made on X, not in a document a player can enforce.Coinbase converts USDT and 13 other stablecoins for EEA retail users on 30 October 2026Coinbase's help centre says retail customers in the European Economic Area have until 30 October 2026 to withdraw 14 stablecoins it can no longer support, including USDT, PYUSD and DAI. Balances still held on 30 October are converted, into USDC where suitable, and coins sent in after the deadline are not credited.

Sources

  1. Solana mainnet RPC, transaction 66E4StZmw1pg37uxdGNTTt8gZHQBh3r6nG7ba4TtTJp2ZLSa6HfDAGewFUNE856EYzUpWzkF37T7TpBMUCPk6wkx and balances of both addresses, retrieved 1 November 2026
  2. Whale Alert, 485,270 SOL transfer labelled Binance Hack 2026, 1 November 2026, retrieved 1 November 2026
  3. Blockscout, Ethereum address 0x8532fa14acaf483729c449b8458aeddb900543d4, retrieved 1 November 2026
  4. Elliptic, The Binance hack is laundering on autopilot, 31 October 2026, retrieved 1 November 2026
  5. Chainalysis, Binance exploit latest findings and response, retrieved 1 November 2026
  6. Chainalysis on X, THORChain pause after an Ethereum reorg, 31 October 2026, retrieved 1 November 2026
  7. crypto.news, Binance hacker moves SOL for Bitcoin swaps via Relay, 1 November 2026, retrieved 1 November 2026
  8. AMBCrypto, how the Binance hacker used Aave after the Tether and Circle freezes, 30 October 2026, retrieved 1 November 2026
  9. Binance, Security Incident Recovery Update #4, 1 November 2026, retrieved 1 November 2026
  10. TheStreet, FBI names who took $6B+ from Binance, 31 October 2026, retrieved 1 November 2026

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.

Add CryptoGuardz as a preferred source on Google to see our pieces more often in Top Stories.