Binance Hacker's Bitcoin Stash Surpasses Coinbase's Corporate BTC Treasury
Key Takeaways
- •The attacker's traced stash of 18,270 BTC, valued near $1.4 billion, surpasses Coinbase's combined investment and operational holdings of 18,071 BTC reported as of Sept. 30 by 199 BTC.
- •Binance confirmed the $6.3 billion hack on Friday, stated that about $3 billion in stolen assets have been frozen, and committed to covering all customer losses.
- •The breach now ranks as the largest single cryptocurrency theft ever recorded, exceeding the roughly $1.5 billion February 2025 attack on Bybit.
- •Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a North Korea-linked hacking group previously tied to the 2022 Ronin Network bridge breach.
- •Bitquery also traced 508,621 ETH to the attackers — more than corporate holder The Ether Machine's 495,362 ETH — with most of it amassed by swapping stolen stablecoins and other tokens after an initial theft of 200,630 ETH.
The perpetrator of the $6.3 billion hack on Binance held more Bitcoin than crypto exchange Coinbase's combined investment and operational holdings at the end of September, according to blockchain analytics data.
Bitquery, a blockchain analytics firm, traced 18,270 Bitcoin (BTC), worth roughly $1.4 billion, to 19 addresses linked to the attacker. Coinbase reported holding 17,954 BTC for investment and 117 BTC for operations as of Sept. 30, a combined total of 18,071 BTC — meaning the hacker's haul exceeded the exchange's corporate holdings by 199 BTC. The figures do not include the BTC Coinbase custodies on behalf of customers.
Based on its 17,954 BTC investment balance, BitcoinTreasuries.net ranks Coinbase eighth among publicly traded companies by Bitcoin holdings.
Binance confirmed on Friday that it had suffered the $6.3 billion hack and said about $3 billion in stolen assets had been frozen. The exchange pledged to cover all losses. The incident is the largest single cryptocurrency theft recorded to date; industry trackers had previously ranked the roughly $1.5 billion February 2025 breach of exchange Bybit as the biggest. The freeze figure, current as of Friday, left roughly $3.3 billion of the haul outside that total, and the attacker's known addresses remain publicly traceable — making further freezes, and any movement of the remaining funds, the immediate markers of the recovery effort.
Blockchain intelligence firm TRM Labs has attributed the attack to TraderTraitor, a hacking group linked to North Korea. TraderTraitor is the designation used in U.S. government advisories for North Korean cyber actors, whose past operations include the 2022 attack on the Ronin Network bridge, and United Nations investigators have reported that stolen cryptocurrency helps fund the country's weapons programs. Binance said investigators have since uncovered additional breach points, after initially suspecting a compromised laptop belonging to a DevOps engineer.
According to Bitquery, 17 of the attacker's Bitcoin addresses each held 1,000 BTC, while the remaining coins sat in two other wallets. The BTC was stolen from Binance hot wallets — internet-connected wallets that exchanges keep funded to process customer withdrawals — during Thursday's breach, which affected nine blockchains in under four hours.
Bitquery also traced 508,621 Ether (ETH) to the attackers as of the same Friday snapshot. That exceeds the 495,362 ETH that BitcoinTreasuries.net attributes to The Ether Machine, which ranks third on the site's list of corporate Ether holders.
The attackers initially stole 200,630 ETH and accumulated the remainder by swapping stolen stablecoins and other tokens, Bitquery added.
