Hackers Move $1.4B in Bitcoin From Binance, Exceeding Major Corporate and National Holdings

Hackers associated with North Korea drained a sizeable stash of bitcoin from Binance on Thursday, moving more than many well-known custodians and even some national reserves hold. The 18,270 BTC taken in the breach surpasses Tesla’s disclosed balance and more than doubles the amount listed in El Salvador’s public reserve wallets.

At an estimated price of $78,500 per bitcoin, the stolen funds equate to roughly $1.4 billion — a sum that approaches the bitcoin holdings reported by SpaceX and vastly eclipses other recent high-profile losses.

Details of the Theft and Attribution

Blockchain investigators at TRM Labs linked the theft to TraderTraitor, a hacking unit tied to the North Korean state, assigning that attribution a high degree of confidence. The FBI has previously connected the same group to a separate $1.5 billion heist against Bybit earlier in 2025. Binance, however, has not publicly confirmed the identity of the actor behind this incident.

According to mempool.space transaction records, the illicit outflow occurred around 4:20 p.m. ET when a hot wallet — an exchange’s internet-connected payout account — sent the entire sum to a newly created address in 11 distinct transactions. That receiving address subsequently fragmented the haul into 19 addresses: 17 contained exactly 1,000 BTC each, while the remaining two held approximately 833 BTC and 438 BTC. As of early Friday morning, those funds had not been moved.

Comparative Context

For context, the 18,270 BTC seized in the breach outweighs Tesla’s reported 11,509 BTC and exceeds El Salvador’s roughly 7,820 BTC reserve. It comes within 442 BTC of SpaceX’s 18,712 BTC disclosed in recent filings. El Salvador began accumulating bitcoin in September 2021; the single-block transfers from Binance represent about 2.3 times the country’s current published reserve.

On-Chain Freezes and Custodial Controls

Significant portions of the stolen crypto have been immobilized on-chain — around $3 billion of the approximately $6.3 billion taken has reportedly been frozen. Much of that containment is the result of stablecoin issuers and custodial platforms exercising built-in controls: companies like Tether and Circle can block token movements from flagged addresses, and exchanges or custodians can refuse deposits or withdrawals of tainted assets to prevent cashouts.

These countermeasures give investigators a chance to intercept funds if the attackers attempt to swap into fiat or other tokens. However, bitcoin itself lacks built-in account freezes, so immobilization relies on off-chain actors and centralized service controls.

Binance’s Response and Ongoing Investigation

Binance’s internal review initially suggested a compromised engineer’s laptop played a role, though subsequent updates indicated additional breach vectors were uncovered. The company stated it had not found evidence of leaked wallet private keys.

To address the fallout, Binance reported it had earmarked more than $6.34 billion in company resources to cover the incident, including $5 billion already held in the affected cryptocurrencies and additional assets being acquired through markets and privately negotiated transactions. Withdrawals from the exchange remained suspended while security checks continued.

Binance also said it would publish refreshed proof-of-reserves data on Monday, Nov. 2, detailing its current holdings and the backing for customer balances.

How the Funds Were Split

After leaving Binance, the funds were quickly redistributed: the newly created receiving address split the total into 19 child addresses to obscure the trail. The pattern of seventeen 1,000 BTC addresses plus the two smaller balances appears designed to complicate tracing and slowing law‑enforcement responses.

Despite on-chain fragmentation, centralized intermediaries retain leverage — by refusing to process deposits from those addresses or by freezing tokens they issue, firms can blunt the attackers’ ability to monetize the theft.

Read all of CoinDesk’s coverage of the Binance hack here.