Binance hacker moves $798K in SOL into Privacy Cash

An address linked to the Binance hacker has deposited nearly $798,000 in Solana into Privacy Cash as the exchange reports progress replacing assets stolen in its $6.34 billion breach.

Summary

• Onchain Lens identified 8,567 SOL deposited into Privacy Cash from an address linked to the hacker.
• Richard Teng said Binance has replenished 98% of affected assets following the Oct. 29 attack.
• Elliptic traced earlier Solana movements through new wallets, lending vaults and conversions into Bitcoin.
• Mercuryo executive Ashna Vaghela said employee training and tighter controls around internal AI tools remain critical.

Onchain Lens said in a Nov. 3 post that the hacker-linked address had deposited 8,567 SOL into Privacy Cash, valuing the transfers at approximately $798,000. The blockchain monitoring account said several other addresses were showing similar activity while it continued tracing and reconciling the funds.

Its accompanying screenshot showed multiple transactions involving Privacy Cash. A follow-up post linked the Solscan account associated with the activity.

BINANCE HACKER STARTS USING MIXER TO LAUNDER STOLEN FUNDS, MIXED 800K SO FAR ⚠️

An address linked to the hacker deposited 8,567 $SOL (~$798K) into Privacy Cash.

Multiple other addresses are showing similar activity. We are monitoring these movements in real time and working to... pic.twitter.com/4wfu2N43vR
--- Onchain Lens (@OnchainLens) November 3, 2026

Binance hacker uses another laundering route

The Privacy Cash deposits follow earlier attempts to move stolen assets between blockchains and through Bitcoin privacy transactions.

In an updated investigation, Elliptic said approximately 87,000 SOL, valued at $8 million, had left the original Solana theft wallet by 08:40 UTC on Nov. 3. Funds passed through new wallets, lending vaults and a liquid-staking service before being sold or converted into Bitcoin.

Elliptic's earlier findings, covered in the CoinJoin report, identified around 28 BTC moving through 18 CoinJoin transactions between Nov. 1 and early Nov. 2.

The firm's updated investigation put the assets remaining in theft-linked addresses at roughly $3.18 billion, mostly in Ethereum and Bitcoin. It assessed that a negligible amount had likely been cashed out.

Those figures describe funds being tracked after the theft. Binance's replacement purchases concern the assets it is acquiring to cover affected customer balances.

Teng says replenishment has reached 98%

Speaking to CNBC on Nov. 3, Binance co-CEO Richard Teng said the exchange had replenished 98% of the $6.34 billion in affected assets and was still purchasing less liquid tokens.

In a separate post, Teng said Binance had completed its latest Proof of Reserves.

His replenishment figure describes Binance's replacement of affected assets; it does not establish that investigators have recovered 98% of the stolen cryptocurrency.

The exchange's account of the breach described a campaign involving fake recruitment interviews, malicious developer software, and access through an internal AI tool. According to Binance, attackers used those entry points to reach the systems authorizing wallet transactions.

Fake recruitment exploits professional trust

Commenting on the attack, Ashna Vaghela, chief customer officer at crypto payments company Mercuryo, said the recruitment approach exposed a security problem that reaches beyond cryptocurrency exchanges.

"The most important detail here isn't technical, it's human," Vaghela told crypto.news.

"This was a months-long campaign aimed at a person rather than a system: a believable recruiter, a believable 'CEO', a routine coding assignment."

She said the approach exploits ambition and professional trust, leaving banks and fintech companies with engineering teams exposed to similar tactics.

"Technical controls matter, but people are the first line of defence, so training has to be continuous and realistic, and it has to cover how staff are approached outside work channels," said Vaghela.

Her comments pointed to staff interactions outside company systems, where apparently ordinary career opportunities can become a route into sensitive infrastructure.

Internal AI tools need privileged access controls

For Vaghela, the use of internal AI tools creates another set of permissions that companies need to secure.

"They sit close to sensitive systems, often carry broad permissions, and are frequently adopted faster than they're secured," she said.

She recommended treating every internal AI tool as a privileged system, with tight access controls and AI-enabled detection. While attackers can use AI to make approaches more convincing and automate attacks, she said defenders can use it to identify vulnerabilities and flag unusual transactions in real time.

"AI alone won't prevent hacks. Strong security architecture, layered controls, continuous monitoring and experienced teams remain critical."

On the response to the theft, she called for shared threat intelligence, faster freezes and cooperation between exchanges, payment providers, banks and regulators.

Elliptic documented one U.S. law-enforcement intervention: the FBI attributed the theft to TraderTraitor and published attacker addresses late on Oct. 31. Its investigation said Circle froze all 823 million stolen USDC before those tokens could be swapped.