CoinDesk
An attacker stole about 18,270 BTC, worth roughly $1.4 billion, from Binance and split the coins across 19 wallets within minutes. Seventeen wallets hold exactly 1,000 BTC each; the other two hold 832.5 BTC and 437.7 BTC. None had sent funds onward as of early Friday. Binance said preliminary findings point to unauthorized withdrawals submitted from a service container accessed through a compromised employee laptop.
Why it matters
The split makes the haul harder to track in a single address, but it does not make the bitcoin untraceable. Unlike stablecoins whose issuers can blacklist addresses, Bitcoin has no central issuer able to freeze coins. The funds can be stopped only if they reach an exchange, an over-the-counter desk or a swap service that intervenes.
TRM Labs attributed the theft with high confidence to TraderTraitor, a North Korean hacking unit. The group was also attributed the $1.5 billion Bybit theft in February 2025; after that attack, it spent about 10 days converting stolen ether into bitcoin.
Market impact
Binance puts its total losses from the attack at $6.3 billion and has pledged to cover them. Deposits and withdrawals remained suspended, adding operational disruption to the financial hit. The stolen BTC had not moved from the 19 wallets as of 04:23 UTC Friday, though the addresses were receiving small spam deposits.
The immediate question for tracking the funds is whether any reach a service able to freeze or intercept them. For Binance, the pledged coverage addresses losses, but the suspension and the reported compromise of a device used to submit withdrawals keep the incident focused on exchange security and customer access.
Frequently asked questions
-
How was the stolen Binance bitcoin divided?
The attacker split about 18,270 BTC across 19 wallets. Seventeen hold 1,000 BTC each, while the others hold 832.5 BTC and 437.7 BTC.
-
Had the stolen BTC moved from the 19 wallets?
None of the 19 wallets had sent funds onward as of 04:23 UTC Friday.
-
Why can’t Bitcoin addresses be frozen by an issuer?
Bitcoin has no central issuer with control over the network who can blacklist an address. The funds can be stopped if they reach an exchange, OTC desk or swap service that intervenes.
-
Who did TRM Labs attribute the Binance theft to?
TRM Labs attributed the theft with high confidence to TraderTraitor, a North Korean hacking unit.
-
What did Binance say about the cause and losses?
Binance said preliminary findings pointed to a compromised employee laptop used to submit unauthorized withdrawals. It put total losses at $6.3 billion, pledged to cover them and suspended deposits and withdrawals.
CryptoSlate
Lookonchain
CoinTelegraph
WatcherGuru
TheBlock
WuBlockchain