Unconfirmed: Did the Binance Attacker Turn a $96 Million SOL Stash Into Bitcoin?

UNCONFIRMED: The originating analyst post is verified. Completion of the entire reported SOL-to-BTC conversion is not independently established.

A large stash moving is not the same thing as the entire stash arriving. On November 1, Lookonchain said the Binance attacker was swapping a reported 970,522 SOL, then valued around $95.9 million, into Bitcoin. Its originating X post described 486,970 SOL, worth roughly $46.4 million at the time, moving during the preceding hour through Relay Protocol.

We verified the post by its actual ID through the public X tools. Brave New Coin subsequently covered the same claim and made the crucial distinction: the larger figure describes the reported pool of stolen SOL, not a confirmed single $95.9 million conversion completed into BTC. That is why the total-completion question in this headline remains UNCONFIRMED.

Tracking a route is not proving a cash-out

The Block later reported Elliptic’s broader assessment that the Binance attackers had converted about $124 million of stolen altcoins into Bitcoin. That supports the general picture of cross-asset movement. It does not independently reconcile every SOL transfer in Lookonchain’s earlier thread, establish the final destination of the whole stash or prove that the funds have been cashed out.

Multiple articles can repeat one analyst’s observation without creating multiple independent investigations. Brave New Coin’s report is useful corroboration that the claim circulated and was examined, but it still attributes the underlying transaction identification to Lookonchain. We have not independently audited the full chain of addresses, bridge execution records and resulting Bitcoin outputs. The attribution stays attached to the analyst rather than becoming our own forensic conclusion.

Bitcoin’s lack of a centralized token issuer can make a stablecoin-style freeze unavailable. It does not erase the public transaction record or prevent a regulated intermediary from flagging a deposit. Neither the use of a cross-chain service nor a move into BTC proves anonymity. The interesting whisper is a potential shift in the attacker’s asset mix. The responsible next step is transaction-level reconciliation, not turning a wallet-monitoring alert into an all-clear that the whole $96 million has escaped. We have a real post, a real report and a clearly bounded unknown.

Originating post: @lookonchain on X. Source: Brave New Coin. Broader context: The Block.