Binance Bitcoin Theft Reaches $1.4 Billion, Exceeding Tesla's Holdings and El Salvador's Reserve
Key Takeaways
- •Approximately 18,270 BTC, valued at about $1.4 billion at $78,500 per coin, left a Binance hot wallet — an amount larger than Tesla's 11,509 BTC holdings and roughly 2.3 times El Salvador's 7,820 BTC reserve.
- •TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-linked hacking group previously blamed by the FBI for the $1.5 billion Bybit theft, though Binance has not confirmed the attacker's identity.
- •The stolen Bitcoin was distributed across 19 addresses and had not been spent as of early Friday morning, keeping the funds traceable and enabling monitoring and deposit-blocking measures.
- •Binance reported that roughly $3 billion of the approximately $6.3 billion in total stolen assets had been frozen onchain, with stablecoin issuers Tether and Circle helping block transfers to designated addresses.
- •Binance allocated more than $6.34 billion in company funds to cover the incident, suspended withdrawals during ongoing security checks, and scheduled updated proof-of-reserves results for Monday, November 2, without providing a timeline for restoring withdrawals.
The Bitcoin stolen from Binance in a recent security breach amounts to roughly $1.4 billion — a sum larger than Tesla's reported holdings of 11,509 BTC and about 2.3 times El Salvador's reserve of approximately 7,820 BTC, according to a report from CoinDesk. The stolen amount is also close to SpaceX's reported holdings of 18,712 BTC. Tesla and SpaceX disclosed their holdings as of September 30 in quarterly filings published this month.
Stolen Bitcoin Exceeds Corporate and National Holdings
The scale of the theft places the stolen Bitcoin above the holdings reported by several prominent corporate and national holders. El Salvador began purchasing Bitcoin in September 2021, making its publicly reported reserve a point of comparison for the amount taken in the Binance incident. Such comparisons anchor the scale of the breach against figures disclosed independently of the exchange — through corporate filings and public reserve reporting.
The movement of 18,270 BTC was confirmed in a single block, according to the report. At the cited price of $78,500 per Bitcoin, the assets were valued at approximately $1.4 billion.
TRM Labs linked the attack with high confidence to TraderTraitor, a hacking unit associated with the North Korean state. The FBI previously blamed the group for the $1.5 billion Bybit theft in February 2025. Binance, however, has not confirmed the identity of the attacker.
How the Bitcoin Left Binance
Blockchain records cited by the report show that the Bitcoin left a Binance hot wallet at approximately 4:20 p.m. Eastern Time on Thursday. Hot wallets are connected to the internet and are used by exchanges to process customer withdrawals.
According to records from mempool.space, the wallet transferred the coins to a newly created address through 11 transactions. The receiving address subsequently distributed the funds across 19 addresses. Seventeen of those addresses held exactly 1,000 BTC each, while the remaining two held approximately 833 BTC and 438 BTC. None of the addresses had spent its Bitcoin as of 2:02 a.m. Eastern Time on Friday, based on the report's cited records. With no spending recorded, the funds remained at identified, traceable addresses — the condition on which monitoring and deposit-blocking measures depend.
Binance Says Billions in Stolen Assets Have Been Frozen
By Saturday morning in Asia, Binance said approximately $3 billion of the roughly $6.3 billion stolen had been frozen onchain. That total is far larger than the $1.4 billion Bitcoin figure, indicating the stolen assets included cryptocurrencies beyond Bitcoin. Stablecoin issuers, including Tether and Circle, contributed to these efforts through controls that allow them to block transfers involving designated addresses.
Bitcoin cannot be frozen directly by a central issuer in the same way as centrally controlled stablecoins. However, exchanges and custodians can block stolen coins deposited on their platforms, potentially allowing investigators to intercept funds when attackers attempt to trade or cash out.
Binance's investigation into the breach remained ongoing. Its initial findings pointed to a compromised engineer's laptop, but a Friday update identified additional points of compromise. The exchange said it had found no evidence that wallet private keys had been leaked.
Binance Sets Aside Funds and Plans Proof-of-Reserves Update
Binance said it had allocated more than $6.34 billion in company funds in response to the incident. That amount included $5 billion already held in the cryptocurrencies affected by the theft. The exchange said it was acquiring the remaining assets through market purchases and privately negotiated trades. The allocation is slightly larger than the roughly $6.3 billion total Binance described as stolen.
Withdrawals remained suspended while security checks continued. Binance also said it planned to publish updated proof-of-reserves results on Monday, November 2, outlining its holdings and the backing for customer balances. The Monday publication is the next scheduled update in the exchange's response, and it had not given a timeline for resuming withdrawals.
Source: CoinDesk
