Massive Binance Bitcoin Heist Split Into 19 Dormant Wallets

On Thursday evening, an attack on Binance saw 18,270 BTC moved out of the exchange’s hot wallet and rapidly divided into multiple parcels. Within minutes the coins were reorganized into 19 separate addresses, and as of early Friday UTC none of those addresses have forwarded any of the stolen funds onward.

The initial outflow occurred at 20:20 UTC when Binance’s hot wallet executed 11 transactions that consolidated just over 18,270 BTC into a single receiving address. Shortly after, the attacker performed a classic peel-chain operation, slicing off standard amounts and passing the remainder through successive hops until the holdings ended up dispersed across distinct wallets.

How the funds were broken down and where they sit now

Transaction pattern: The departing funds were handled like ordinary exchange withdrawals: each transfer bore valid signatures from addresses associated with Binance and resembled routine withdrawal structures, including change outputs returning to Binance-controlled addresses. After the consolidation, the attacker split the balance into predictable chunks — seventeen wallets contain exactly 1,000 BTC each, a single wallet holds 832.5 BTC, and another holds 437.7 BTC.

No onward movement: Blockchain observers confirmed that, by 04:23 UTC Friday, none of the 19 addresses had spent a single satoshi. The only subsequent activity directed at those addresses has been inconsequential: unrelated third parties sending tiny, low-value deposits worth a dollar or two.

Why these coins are harder to freeze than stablecoins

Unlike tokens issued by entities such as Tether, Circle, or Ripple — whose contracts can be updated to blacklist addresses — bitcoin lacks a central issuer with the power to freeze or blacklist specific UTXOs. That means the stolen BTC can only be contained if they are intercepted when presented to a custodial exchange, an OTC desk, or a swap service willing to cooperate with law enforcement or compliance controls.

Attribution and prior patterns

Security firm TRM Labs attributed the theft to TraderTraitor, a hacking group linked to North Korea’s elite cyber unit, with high confidence. TRM noted parallels to a prior campaign that converted stolen ether into bitcoin after the February 2025 Bybit breach, suggesting a recurring modus operandi in converting and laundering large cryptocurrency hauls.

Binance’s statement and internal findings

Binance’s early probe indicates the attacker likely exploited a compromised laptop used by a DevOps engineer to gain access to a service container, which then enabled unauthorized withdrawal submissions. The company stated there is no evidence that private keys controlling any wallets were exfiltrated. Binance estimates the total impact at about $6.3 billion and has pledged to cover customer losses. Meanwhile, deposits and withdrawals remain suspended while the exchange continues its investigation.