What happened
The wallet cluster tied to the $6. 3 billion Binance breach executed another round of SOL-to-BTC conversions on Tuesday, according to U. Today, which cited on-chain trackers monitoring the address set.
The attacker is routing funds through a series of cross-chain transactions rather than dumping Solana directly into a single venue. That pattern has been consistent since the exploit was first disclosed: break the bag into smaller legs, bridge out of Solana, swap into Bitcoin, and park. Each tranche reduces the SOL exposure and grows the BTC pile.
The most recent hops were visible in the early European session on November 4.
Why it matters
A $6. 3 billion stolen bag is large enough to move markets just by being moved. When the attacker chooses Bitcoin as the end asset, every rotation is a forced bid on BTC and a forced offer on SOL.
That is not a trading view. It is mechanical flow. The headline framing is bullish for Bitcoin because the buyer is price-insensitive.
The flow picture for Solana is the opposite: a known, non-economic seller is working through size on a schedule the market cannot see in advance. Compliance desks at major venues are now in a position where accepting any downstream deposit carries tagging risk, which is why the attacker is favoring cross-chain routing over a single centralized exchange.