TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A transfer of 18,270 bitcoin from Binance on Thursday is at the center of a reported theft valued at about $1.4 billion. TRM Labs attributed the attack with high confidence to North Korean group TraderTraitor, while Binance had not identified the attacker and said roughly $3 billion of about $6.3 billion in stolen cryptocurrency had been frozen.
About 18,270 bitcoin was taken from Binance in a reported theft on Thursday, an amount worth roughly $1.4 billion at a cited price of $78,500 per coin and larger than Tesla’s disclosed bitcoin holdings. Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group, but Binance had not named the attacker as of Saturday.
Records from blockchain data site mempool.space show that a Binance hot wallet sent the bitcoin to a new address at about 4:20 p.m. ET Thursday, in 11 transactions. The receiving address then divided the funds among 19 addresses: 17 held 1,000 BTC apiece, while the other two held about 833 BTC and 438 BTC. None of those addresses had spent the bitcoin as of 2:02 a.m. ET Friday, according to the report.
The 18,270 BTC exceeds the 11,509 BTC Tesla reported holding in a quarterly filing. It is also more than twice the roughly 7,820 BTC in reserve wallets published by El Salvador’s National Bitcoin Office as of Friday. The amount is 442 BTC below the 18,712 BTC disclosed by SpaceX. Tesla and SpaceX figures were reported as of Sept. 30 in quarterly filings published this month; the comparison is by quantity, while the estimated dollar value depends on bitcoin’s market price.
Binance said approximately $3 billion of roughly $6.3 billion stolen across cryptocurrencies had been frozen onchain as of Saturday morning in Asia. The exchange also said it had set aside more than $6.34 billion in company funds to cover losses, including $5 billion it already held in the affected cryptocurrencies, and was acquiring the remaining assets through market purchases and privately negotiated trades. Binance said withdrawals remained suspended.
The Scale of the Reported Theft
The quantity involved gives readers a concrete measure of the incident: the reported bitcoin transfer alone is larger than the holdings disclosed by Tesla and more than twice El Salvador’s published reserve. Those comparisons describe the size of the bitcoin amount, not a loss to either Tesla or El Salvador; neither was identified as a victim in the report.
The incident also has implications beyond bitcoin. The broader reported theft totals about $6.3 billion across cryptocurrencies, and Binance’s stated freeze figure is about $3 billion. Freezes can limit the attackers’ ability to move some assets, but they do not establish that all stolen funds can be recovered. Binance’s suspension of withdrawals also affects customers’ ability to access the exchange while its response continues.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
Transfers, Attribution and Recovery
The transfer left a hot wallet, an internet-connected wallet used by an exchange to process customer withdrawals. The source material says Binance’s initial investigation pointed to a compromised engineer’s laptop, but a Friday update described additional points of entry. The exchange said it had found no evidence that wallet private keys leaked. Those statements describe the investigation to date, not a final account of how the incident occurred.
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI had blamed the same group for the $1.5 billion Bybit theft in February 2025, according to the report. Binance had not publicly identified the attacker. The attribution by TRM Labs should therefore be distinguished from a finding announced by Binance or law enforcement about this incident.
Some cryptocurrency can be frozen when it is held in tokens with issuer controls or reaches an exchange or custodian able to block deposits. The report said much of the roughly $3 billion frozen was protected with help from stablecoin issuers Tether and Circle, whose dollar-pegged tokens can be blocked at specific addresses. Bitcoin does not have an issuer with the same token-freezing controls, though exchanges and custodians may be able to stop funds deposited with them.
“The attack was attributed “with high confidence” to TraderTraitor.”
— TRM Labs
Unresolved Questions in Binance’s Probe
The full method of entry remains unclear. Binance’s initial focus on a compromised engineer’s laptop was followed by an update citing additional points of entry, and the exchange has not provided a complete explanation in the supplied report. It is also not clear how much of the reported stolen cryptocurrency will ultimately be recovered or whether the bitcoin held at the listed addresses has since moved.
The attacker attribution remains unconfirmed by Binance in the available information: TRM Labs made the high-confidence assessment, while Binance had not publicly named a perpetrator. The report also does not give a final breakdown of how much of the overall $6.3 billion figure is bitcoin versus other cryptocurrencies, or detail the circumstances behind the suspension of withdrawals and when they may resume.
Recovery and Withdrawal Updates
The immediate milestones are further updates from Binance on its investigation, the status of suspended withdrawals, and any changes to the amount reported frozen or recovered. Monitoring the destination addresses may show whether the bitcoin remains unmoved or is sent to exchanges and custodians that could block deposits.
Binance said it was acquiring assets to complete the company funds set aside to cover losses. The available report does not give a schedule for completing those purchases or restoring withdrawals. Until the exchange or investigators provide more information, the breach’s full entry path, the attacker’s identity and the final recovery total remain unresolved.
Key Questions
How much bitcoin was reportedly taken from Binance?
The report says 18,270 BTC was transferred from a Binance hot wallet on Thursday. At the cited price of $78,500 per bitcoin, it was worth about $1.4 billion.
How does the amount compare with Tesla’s and El Salvador’s holdings?
The 18,270 BTC is greater than Tesla’s reported 11,509 BTC and more than twice El Salvador’s approximately 7,820 BTC in published reserve wallets. These are comparisons of reported quantities, not evidence that either Tesla or El Salvador lost bitcoin.
Who does TRM Labs say was behind the attack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group. Binance had not identified the attacker in the information available in the report.
How much of the reported stolen cryptocurrency has been frozen?
Binance said approximately $3 billion of roughly $6.3 billion stolen across cryptocurrencies had been frozen onchain as of Saturday morning in Asia. The report does not establish how much will ultimately be recovered.
When will Binance withdrawals resume?
The report says withdrawals remained suspended, but gives no resumption date. Binance had not supplied a timetable in the information provided.
Source: coindesk.com
