Binance hot wallet drained of 18,270 BTC
A hot wallet linked to Binance sent 18,270 bitcoin to a new address late Thursday, according to mempool.space records. The transfer happened in 11 transactions at about 4:20 p.m. ET. The receiving address then split the funds across 19 addresses. Seventeen of those addresses held exactly 1,000 BTC each, while the other two held about 833 BTC and 438 BTC. None had moved its holdings as of early Friday, the records showed.
At $78,500 per coin, the haul is worth roughly $1.4 billion. That is more than Tesla’s disclosed 11,509 BTC and more than twice the roughly 7,820 BTC listed in El Salvador’s reserve wallets as of Friday. It also comes within 442 BTC of SpaceX’s 18,712 BTC. Both companies reported those holdings as of Sept. 30 in quarterly filings this month.
Attribution points to North Korea
Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI blamed the same group for the $1.5 billion Bybit theft in February 2025. Binance has not named the attacker. The exchange’s first explanation pointed to a compromised engineer’s laptop. A Friday update said investigators found additional breach points, though Binance said it had no evidence that wallet private keys leaked.
Funds split across wallets
The split into 19 addresses is perhaps a familiar move for stolen funds. It spreads the coins and may make tracing harder, though blockchain records remain public. Binance and investigators can still act when the bitcoin touches an exchange or custodian. Stablecoin issuers such as Tether and Circle also have controls that let them block transfers from particular addresses.
As of Asian morning hours Saturday, Binance said about $3 billion of the roughly $6.3 billion stolen had been frozen onchain. Much of that protection came from stablecoin issuers, the exchange said. It is not clear whether all of the frozen amount is directly tied to the Binance theft or how much may be recovered eventually.
Binance fills the gap
Binance said it had set aside more than $6.34 billion in company funds. That includes $5 billion already held in the cryptocurrencies affected by the theft. The exchange said it was buying the remaining assets through markets and privately negotiated trades. Withdrawals stayed suspended during security checks. Binance plans to publish updated proof-of-reserves results on Monday, Nov. 2, showing its holdings and the backing for customer balances.
The size of the loss puts the Binance theft near the top of crypto hacks. It is larger than the corporate reserves held by Tesla and El Salvador’s national stash. SpaceX is only slightly bigger. For now, the trail is public, the wallets are watched, and the recovery effort is still moving.
