Binance Hacker Moves $46.4M in Stolen SOL Through Relay Protocol
The hacker behind the 2022 Binance bridge exploit has resumed laundering operations, routing $46.4 million in stolen Solana through Relay Protocol to facilitate Bitcoin swaps, according to on-chain data reported on October 31, 2026. The move follows a larger conversion of $279 million in altcoins, signaling a renewed push to obscure the origin of funds across multiple chains.
Relay Protocol, a cross-chain bridge that supports fast, low-cost transfers between Solana and Ethereum-based assets, has become a preferred route for the attacker. By swapping SOL for BTC, the hacker reduces the traceability of stolen assets and diversifies holdings into the most liquid cryptocurrency. The $46.4 million transfer represents a fraction of the estimated $570 million stolen in the October 2022 BNB Chain bridge hack, but the renewed activity has drawn fresh scrutiny from blockchain analysts.
Why Relay Protocol Becomes The Laundering Conduit
Relay’s architecture allows users to bridge assets without relying on centralized exchanges, which typically enforce know-your-customer checks. That makes it attractive for bad actors seeking to move funds across chains while maintaining anonymity. The protocol’s liquidity pools, which rely on market makers and automated market makers, can absorb large transfers without triggering the same level of surveillance as centralized platforms.
The hacker’s strategy appears to be a two-step process: first, convert a broad basket of altcoins into SOL, then bridge that SOL to Bitcoin via Relay. The $279 million altcoin conversion, completed in earlier tranches, likely involved tokens such as BNB, BUSD, and other assets drained from the bridge. By consolidating into SOL, the attacker reduces the number of wallets and simplifies the laundering chain before the final Bitcoin swap.
On-chain analysts have flagged the movement of these funds to Relay, noting that the protocol’s smart contracts have processed the transactions without apparent interruption. The hacker’s wallets remain active, suggesting that further transfers are likely in the coming days.
Solana Price Under Pressure As Stolen Supply Hits Market
Solana (SOL) traded at $95.31 on October 31, 2026, down 0.87% for the day, according to Massive data. The price weakness coincides with the hacker’s transfers, though it is difficult to isolate the direct impact given broader market conditions. Bitcoin (BTC) changed hands at $77,423.98, up 0.32% over the same period, showing relative resilience as the stolen SOL is swapped into BTC.
The conversion of $46.4 million in SOL to Bitcoin could add selling pressure to Solana while providing marginal buying support for BTC. However, the amounts are small relative to daily trading volumes, and the market impact may be limited unless the hacker accelerates the pace of transfers. The $279 million altcoin conversion, if fully liquidated, would represent a larger overhang, but much of that has already been absorbed.
Market participants are watching whether the hacker will continue to use Relay or shift to other bridges, which could signal a change in strategy or a response to increased monitoring.
Relay Protocol’s Role In Cross-Chain Security Debates
Relay Protocol’s involvement highlights a broader challenge in decentralized finance: cross-chain bridges remain a weak point for security and compliance. Unlike centralized exchanges, which can freeze funds and cooperate with law enforcement, bridges are often permissionless and operate without identity checks. That design is core to their value proposition but also makes them a target for laundering.
The Binance hacker’s use of Relay is not the first time the protocol has been linked to illicit flows. Earlier in 2026, blockchain analytics firms flagged other bridge exploits that leveraged similar cross-chain infrastructure. Relay’s developers have not publicly commented on the specific transactions, and it is unclear whether they have the ability to block addresses associated with the hack.
The incident may intensify calls for bridge operators to implement voluntary screening tools or risk-based controls, though such measures could undermine the permissionless ethos of DeFi. Regulators in the United States and European Union have been examining cross-chain risks, but no comprehensive framework has been finalized as of November 2026.
Solana Hacker House London 2026 Kicks Off Amid Security Concerns
On November 1, 2026, the Solana Hacker House London 2026 begins in London, United Kingdom, ahead of Breakpoint 2026. The event brings together developers, founders, and blockchain enthusiasts to explore opportunities within the Solana ecosystem. While the gathering is focused on innovation, the timing coincides with the hacker’s renewed activity, underscoring the tension between building and securing the network.
Solana’s developer community has been resilient despite past exploits, and the Hacker House is expected to showcase new projects and tools. However, the presence of stolen funds moving through Solana-linked bridges may cast a shadow over discussions of security and trust. Attendees may address the need for better monitoring and incident response frameworks.
The event runs at the International Vedanta Society in London, with a focus on turning ideas into products. For the Solana ecosystem, the challenge is to demonstrate that security can keep pace with growth.
What To Watch: Relay Transfers And BTC Inflows
The next key data point will be whether the hacker continues to route funds through Relay Protocol or diversifies to other bridges. A sustained pace of transfers above $10 million per day would suggest a more aggressive laundering schedule and could weigh on SOL. Conversely, a pause might indicate that the attacker is reassessing options or that law enforcement or bridge operators have taken action.
Investors should also monitor Bitcoin inflows from known hacker wallets. If BTC begins to move to centralized exchanges, that could precede a large sell-off and add volatility to BTC’s current $77,000 level. The $95.31 support on SOL is critical; a break below could trigger further downside. The coming week will reveal whether the hacker’s activity is a one-off event or the start of a sustained campaign.
Sources: rss_autopost · SOL Newsroom · CoinDesk · CoinGape · Binance