SomaXBT analyzed 47,644 transactions from wallets handling funds stolen in the USD 6.36 billion Binance hack and assessed about 54% as clearly automated from their timing and repeated transaction settings. In one November 3 wave, an FBI-listed Solana wallet routed 386,724 SOL through 34 throwaway wallets, Jupiter Lend deposits and receipt transfers, then sold 27,060 SOL for USDC and bridged USD 2.4 million to dYdX accounts. The analysis says the script handled repeated execution while operators selected route and sale size, allowing value to move seven to ten hops away from a listed wallet before screening systems could label new addresses.