The attacker behind the Binance breach has moved 18,270 stolen BTC into 19 separate wallets, splitting the funds within minutes of receiving them. Blockchain records show that none of the coins has been transferred out of those addresses since Thursday night.
CoinDesk’s examination of the transactions found that 17 wallets each contain exactly 1,000 BTC. The remaining two addresses hold 832.5 BTC and 437.7 BTC, respectively. All 19 wallets have recorded zero outgoing transactions since the funds arrived.
The movement began at 20:20 UTC on Thursday, when Binance’s hot wallet sent slightly more than 18,270 BTC to a single address through 11 separate transfers. All transactions were confirmed in block 973,732.
A hot wallet is an internet-connected cryptocurrency wallet that exchanges use to process withdrawals. Based on early Friday market prices, the transferred bitcoin was valued at approximately $1.4 billion. This is more than 2.5 times the 7,000 BTC stolen from Binance during its 2019 hack, when Bitcoin’s price was below $5,000.
The attacker began distributing the funds almost immediately after the initial transfer. The transactions used to divide the bitcoin were confirmed in the same block as the original deposits.
CoinDesk traced the movement of the funds using mempool.space blockchain data. The analysis revealed a technique called a peel chain, in which a transaction sends a fixed quantity of bitcoin to a newly created address and forwards the remaining balance to another wallet.
The attacker repeatedly used this method to separate 1,000 BTC into individual addresses. Smaller leftover amounts were occasionally combined and divided again. Toward the end of the process, the remaining irregular balances were consolidated into a wallet containing 832.5 BTC.
Another transfer followed 28 minutes later. Confirmed in block 973,738, the transaction sent 437.7 BTC to the 19th wallet.
The distribution now consists of 17 addresses holding 1,000 BTC each, one containing 832.5 BTC and another holding 437.7 BTC. As of 04:23 UTC on Friday, no bitcoin had left any of the 19 wallets.
The only activity recorded afterward involved small unsolicited deposits. Unknown users began sending tiny amounts of bitcoin, worth approximately $1 or $2, to the addresses late Thursday.
Bitcoin’s Lack of a Central Issuer Limits Freezing Options
The stolen bitcoin is more difficult to freeze than the stablecoins taken during the same incident.
Companies such as Tether, Circle and Ripple control the smart contracts behind their stablecoin products. This allows them to blacklist specific wallet addresses and prevent the associated tokens from being transferred.
Bitcoin has no central issuer with similar control over its network. Consequently, the stolen coins can generally be intercepted only when they reach a centralized exchange, an over-the-counter trading service or a cryptocurrency swap platform that chooses to restrict them.
Blockchain analytics firm TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with what it described as high confidence.
The group was also associated with the February 2025 Bybit breach, which resulted in approximately $1.5 billion in stolen funds. Following that attack, TraderTraitor reportedly spent around 10 days converting the stolen ether into bitcoin.
Binance Says Compromised Engineer Laptop Enabled Unauthorized Withdrawals
The structure of the 11 original transfers indicates that they were processed similarly to standard Binance customer withdrawals.
One transaction included 18 separate bitcoin inputs from an address identified as belonging to Binance by blockchain tracker Whale Alert. The funds were sent to the attacker’s wallet, while the remaining change was returned to an address controlled by the exchange.
Each of the 11 transactions carried a valid signature from Binance-controlled bitcoin addresses.
In an October 26 post on X, Binance said its preliminary investigation identified a compromised laptop belonging to a DevOps engineer as the likely entry point. The attacker allegedly used the device to access a service container and submit unauthorized withdrawal requests.
The exchange said it had found no evidence that the private keys associated with its wallets were exposed.
Binance has estimated the total damage at approximately $6.3 billion and promised to cover all affected losses. Deposits and withdrawals remain suspended as the company continues investigating the incident.
