Binance hacker swaps $46M of stolen SOL into Bitcoin

• The Binance hacker is swapping 970,522 stolen SOL, about $95.9M, into BTC
• Roughly 486,970 SOL moved in the past hour via RelayProtocol
• BTC near $77,981 absorbed the buy flow with almost no price reaction

The Binance hacker just routed $46M of stolen SOL into Bitcoin in a single hour, and the price barely twitched. So who quietly took the other side of that trade?

The Binance hacker is on the move again. In the past hour, the attacker shifted roughly 486,970 SOL, worth about $46.4M, and began swapping it for Bitcoin through the RelayProtocol bridge. It is one slice of a much larger holding: 970,522 SOL, around $95.9M, now being funnelled into BTC.

This is not a new face on the tape. The same hacker has already churned more than 130 stolen tokens into roughly $279M of ETH and USDC. SOL is simply the next line on the ledger.

The context around it keeps shifting too. Binance says it has replenished about 90 to 95% of the assets lost in the roughly $6.3B hack, with plans to cover the rest. Frozen funds tied to the attacker have climbed to around $3B, up from $2.54B earlier.

So here is the part worth sitting with. A $46M forced seller rotated into Bitcoin, and BTC moved less than a tenth of a percent on the hour. The market was, politely, unimpressed.

That muted response is the real story, not the hack headline itself. SOL, the asset actively being sold, slipped only about 0.42% on the day. Neither side of this trade produced the panic you would expect from flows of this size. It reads less like conviction and more like a forced, laundering-adjacent cleanup, converting a volatile altcoin position into the most liquid asset available before anyone else can freeze it.

A forced seller the tape shrugged off

The mechanism here matters more than the dollar figure. A hacker rotating stolen SOL into BTC is not expressing a market view. It is consolidating risk and moving value into the deepest, most fungible asset available, which reads as laundering-adjacent behaviour rather than a directional bet.

That distinction changes how the flow transmits. Organic demand tends to lift price because it reflects conviction. Forced or opportunistic selling simply needs a willing counterparty, and if that counterparty is deep enough, price can swallow the flow whole.

The backdrop sharpens the point. This is landing on an already cautious tape, with a Fear reading near 34 and total crypto market cap around $2.64T. Equities and large-caps have been soft, so any hacker-driven noise is hitting on top of existing weakness, not a calm market.

And yet BTC held. Tens of millions in forced buy flow arrived in an hour, and Bitcoin barely registered it. That tells you the liquidity on both sides of this trade was thick enough to absorb a seller of real size.

There is a wry lesson in that. For every headline warning that hacker flows will crater the market, the order book quietly did its job and moved on. So the honest read is that this is a crypto-specific supply event, not a systemic one. It presses on SOL and on the previously dumped alts, but it is being absorbed rather than amplified across the broader market.

Where the selling actually lands

Start with the asset being sold. SOL carries the clearest pressure here, because it is the position the hacker is liquidating. On the day it was mildly red, around 0.42% lower, and a persistent forced seller caps any attempt to bounce until the stack clears.

Bitcoin sits on the other side as the buyer, yet it is the one showing composure. BTC was near $77,981 and up about 0.7% on the day, with the one-hour change essentially flat. The buy flow was real; the price impact was not. That asymmetry is the tell. When a buyer of this size cannot lift price, deep two-way liquidity is doing the work, and that usually points to larger participants comfortably supplying into the move.

For ETH, the second-order read is quiet. The hacker has already parked most proceeds in ETH and USDC, so this SOL leg is incremental rather than a fresh ETH event. Ethereum trades on its own softer flows today, not this swap.

The alts are where the residue sits. The previously dumped names, think UNI, ENA, PEPE, LINK and AAVE, still carry their own separate sell overhang from earlier rotations. This SOL move adds to that drip of hacker-linked supply without creating a new cascade.

Net of all that, the impact looks contained rather than contagious. The direct victim is SOL and the alt complex absorbing hacker supply, while BTC behaves like the drain everything flows into, calmly.

Signs the SOL rotation is winding down

The first thing to track is the size of the remaining stack. The hacker still holds a meaningful chunk of the original 970,522 SOL, so each further tranche into BTC via the bridge is fresh, mechanical SOL supply. Watch the on-chain pace: faster rotation means the overhang clears sooner.

Confirmation that this is contained looks like SOL stabilising even as the swaps continue. If SOL holds roughly flat while the hacker keeps selling, the market is absorbing the flow, and the event stays a footnote rather than a trend.

Invalidation looks different. If SOL starts breaking lower on visibly larger tranches, or if the alt complex that already ate hacker supply begins sliding together, then the drip is becoming a trend and real participants are stepping back from the bid.

On the BTC side, the thing to respect is a change in character. So far Bitcoin has absorbed the buying without momentum. If that quiet buy flow ever coincides with BTC stalling and rolling over, that is distribution dressed as demand, not strength.

Keep an eye on the restitution storyline too. Binance moving from roughly 90% toward 95% coverage, and frozen funds climbing past $3B, both shrink the economic sting of these flows over time. And watch sentiment honestly. The Fear reading near 34 predates this swap and overlaps with wider equity weakness, so do not pin the whole mood on one hacker wallet.

Reading the muted response through liquidity

The ParadiseTeam frames this through one question: if a $46M forced seller cannot move Bitcoin, who is comfortably standing on the other side? That answer matters more than the hack headline.

BTC was trading near $77,981 as of this flow, sitting just under the former support zone around $79,000 that we now treat as neutral. In our read, hacker supply does not change that structure. The level does.

Our standing view is cautious here, and for good reason. The repositioning that matters was already done: large players de-risked from higher, and a tracked whale flipped short before the hack even landed. News like this swap acts as a catalyst into structure that was set in advance, not as the cause of the next move.

So the line we care about is the reclaim of that $79,000 band as resistance. Lose the hacker noise for a second: without a clean reclaim, strength into $79,000 is where selling can meet the bid, which keeps the medium-term read defensive.

Retail tends to read a hacker buying Bitcoin as a bullish tell. The ParadiseTeam reads it as a forced seller cleaning up, absorbed by deeper hands, with the real decision still at the level above.

Stops to respect sit on both sides of SOL near its day's range and on any failed BTC push into $79,000. Until BTC reclaims that zone, this swap stays supply, not demand.

The read behind this: we framed this story through our own market analysis, Binance Hack: Is Bitcoin's Small Drop Bullish?

Related coverage

• Binance says 90 of stolen funds back restart sunday
• Reserve says stolen rsr sold binance to cover losses

For exact entries, targets, and stop losses with full risk management, that is what ParadiseFamilyVIP is for. New to reading these moves? Start with our crypto trading strategies guide.

ParadiseTeam is monitoring the market situation closely, and we are taking these developments into consideration while building our trading tactics inside ParadiseFamilyVIP.