The Binance hackers finally made their move on SOL, but after all that trouble, they ended up getting Bitcoin in return. According to ChainCatcher, citing Lookonchain, the hackers are exchanging approximately 970,000 stolen SOL for BTC, worth about $95.9 million. Just a day ago, the FBI specifically requested DeFi and instant exchange services to help intercept the transactions. Has this net tightened? Tonight's on-chain records provide a less than optimistic answer. Let's recap the timeline. According to PANews, citing Whale Alert, at 17:39 Taipei time today, over 485,000 SOL were transferred from the Binance hacked address, worth approximately $46.35 million at the time of the transfer. PANews specifically noted at the time that transferring does not equate to selling. By 18:38, ChainCatcher reported that the hackers had transferred approximately 487,000 SOL in the past hour, currently exchanging them for Bitcoin via the Relay Protocol. According to TRM Labs, the stolen SOL totaled approximately 970,000, meaning the hackers intended to replace an entire bag of SOL. The contrast lies in the statement released the previous day. According to Cointelegraph, the FBI issued a statement on Saturday saying it observed that most of the stolen funds were initially converted to Ethereum and anticipated that the hackers would continue laundering through DeFi and instant exchange services. Therefore, it called on node operators, instant exchange platforms, DeFi services, and on-chain analytics companies to intercept transactions associated with these addresses. Then, at 18:29 today, the cross-chain protocol Symbiosis posted that it had discovered someone attempting to transfer the stolen funds through it, and the team was intercepting them and had contacted Binance. It also acknowledged that existing screening methods were designed for normal fund flows, and that monitoring gaps existed when encountering rapid and complex operations. Let's say you're just an ordinary user who happened to make a cross-chain transaction on Symbiosis today. Symbiosis is also asking users whose funds were suspended or mistakenly rolled back to contact their team for verification. You might not even know that hackers were using the same channel at the same time. As for why the hackers specifically chose Bitcoin, ChainCatcher explains that BTC has better liquidity, wider acceptance, and is easier and faster to transfer. Furthermore, Bitcoin has no issuer, so no one can freeze it. According to reports, this $95.9 million only accounts for about 1.5% of the approximately $6.3 billion stolen. There are still about 200,000 ETH, 18,270 Bitcoins, and a large number of stablecoins. Binance only started resuming withdrawals in phases today. In my opinion, this recovery effort has shifted from "who can freeze" to "who reacts faster." The FBI's address list, the labels of on-chain analytics companies, and the risk control systems of each protocol—every link needs to react within tens of minutes. A moment's delay could mean tens of millions of dollars changing currency and blockchain. According to data from CertiK cited by Cointelegraph, estimated crypto security losses totaled approximately $3.4 billion in 2025, with over $2 billion attributed to North Korean-related groups. Roughly speaking, this single incident alone exceeds the total losses for the entire year. The cat is a group of protocols each managing their own section, while the mouse is just one, but it doesn't need to hold meetings. Do you think DeFi protocols should screen every transaction like exchanges, prioritizing preventing hackers over potentially harming ordinary users, or should they uphold permissionless access, allowing hackers to use the service? Other key points today are shown in the image: Binance hack, North Korean hackers, Crypto Evening News