Key Takeaways:
- The Binance hacker wallet deposited 8,567 SOL, or approximately $798,000, to Privacy Cash.
- Elliptic mapped the laundering chain over approximately 12,000 wallets and 11 blockchains.
- Approximately $3.18 billion of stolen crypto is in addresses related to the attack.
The laundering process is rapidly evolving for activities linked to Binance’s massive hack on Solana, with the stolen tokens now traveling through a privacy-focused mixer. Onchain Lens said a hacker-linked address deposited 8,567 SOL, valued at roughly $798,000, into Privacy Cash, while other related wallets showed similar activity.
BINANCE HACKER STARTS USING MIXER TO LAUNDER STOLEN FUNDS, MIXED 800K SO FAR ⚠️
An address linked to the hacker deposited 8,567 $SOL (~$798K) into Privacy Cash.
Multiple other addresses are showing similar activity. We are monitoring these movements in real time and working to trace and reconcile the full flow of funds.
@binance
— Onchain Lens (@OnchainLens) November 3, 2026
Read More: Binance $6.3B Hack Triggers FBI Probe While $3B in Stolen Crypto Gets Frozen
Binance Hacker Adds Privacy Cash to Laundering Route
The thefts of assets in Binance’s October 29 hack continue, with the Privacy Cash transfers as another development. Onchain Lens claims to be tracking the activity on stream and the work it is trying to connect the dots on the flow of funds.
Cross-chain moves in Ethereum, Tron, Solana, Bitcoin and other chains have occurred over the past few days for the SOL movement. In its first three and a half days, Elliptic estimates laundering was conducted on approximately 12,000 wallets on 11 blockchains, resulting in over 40,000 transactions.
Read More: Binance Restores 15 Networks After $6.3B Hack While Outflows Surge to $5.8B
SOL Is Being Split, Routed and Converted Into Bitcoin
Solana has become one of the active laundering routes. By November 3, about 87,000 SOL, worth roughly $8 million, had left the original theft wallet, according to Elliptic. This money was spread out for new addresses, turned into lending vaults and a liquid-staking service after which it was offered or exchanged for Bitcoin.
There was then a total of approximately 825,000 SOL in those addresses, the majority being held in two. The new entry into Privacy Cash seems to be a ploy to strengthen the embezzlement of funds while obscuring the obvious connection between incoming and outgoing transactions.
Laundering Network Already Spans Thousands of Wallets
Most beginning washing was done via Tron. The stolen TRX was spread out among roughly 7,700 TRX addresses and parts of its value were converted into Ethereum. Through various cross-chain bridges, at least $147 million has been withdrawn from Tron so far.
The aggressor has also switched both the assets and the networks by leveraging decentralized exchanges, lending platforms, and cross-chain swap services many times. The mixing of bitcoins started on the 1st of November. By early November 2, approximately 28 BTC worth of approximately $2.2 million went through a total of 18 CoinJoin transactions of WabiSabi variety.
The activity conveys the impression of being very automated, features set transaction patterns, amounts and the speed of wallet generation, Elliptic said. The quick operation resulted in approximately 32,000 transactions on Tron, the highest of which occurred at 1300 transactions per hour.
$3.18B in Stolen Crypto Still Remains Onchain
Regardless of the amount of laundering, the bulk of the stolen crypto isn’t out of the vault yet. As of Nov. 3, Elliptic estimated that $3.18 billion was left in theft-connected addresses, most of it in ETH and BTC. An additional $2.85 billion was already frozen or seized.
So far only minimal amounts have been on to a cash-out channel, the firm said. That means centralized exchanges and OTC brokers are essential places to catch and freeze.
