The Binance hack resulted in the theft of 18,270 BTC, worth approximately $1.4 billion at current prices. The stolen amount is greater than Tesla’s reported Bitcoin holdings, more than twice El Salvador’s national reserve and only 442 BTC below SpaceX’s disclosed position. Blockchain investigators have pointed to a North Korean hacking group as the likely perpetrator.
The 18,270 BTC taken from Binance on Thursday exceeds Tesla’s reported stash of 11,509 BTC. It also significantly outweighs El Salvador’s Bitcoin reserves, which stood at approximately 7,820 BTC in wallets published by the country’s National Bitcoin Office as of Friday.
At an estimated price of $78,500 per Bitcoin, the stolen funds are valued at around $1.4 billion. SpaceX, meanwhile, reported holding 18,712 BTC as of Sept. 30, placing its reserves just 442 BTC above the amount stolen from Binance. Tesla and SpaceX revealed their Bitcoin holdings in quarterly filings published this month.
El Salvador has been purchasing Bitcoin since September 2021. The Binance attackers transferred an amount equivalent to approximately 2.3 times the country’s current holdings, with the transactions confirmed in a single blockchain block.
TRM Labs, a blockchain intelligence company, attributed the attack to TraderTraitor with a high level of confidence. The group is associated with North Korea and was previously blamed by the FBI for the $1.5 billion Bybit hack in February 2025. Binance has not publicly confirmed the identity of the attackers.
Stolen Bitcoin transferred to 19 addresses
The movement of funds began at approximately 4:20 p.m. ET on Thursday, when a Binance hot wallet transferred the Bitcoin to a newly generated address. According to mempool.space data, the exchange’s internet-connected wallet, which processes customer withdrawals, completed the transfer through 11 separate transactions.
The receiving address subsequently distributed the funds across 19 different wallets. Seventeen addresses received exactly 1,000 BTC each, while the remaining two collected approximately 833 BTC and 438 BTC. Blockchain records showed that none of these wallets had spent its Bitcoin as of 2:02 a.m. ET on Friday.
Binance freezes $3 billion as recovery efforts continue
Binance reported that it had frozen approximately $3 billion of the estimated $6.3 billion stolen by Saturday morning in Asia.
Stablecoin issuers Tether and Circle have helped restrict the movement of some funds through their ability to blacklist specific wallet addresses. Their dollar-pegged tokens include controls that allow the companies to prevent transactions involving designated addresses.
Cryptocurrency exchanges and custodial services can also freeze stolen Bitcoin deposited on their platforms. This gives investigators additional opportunities to intercept the assets if the attackers attempt to trade or convert them into other cryptocurrencies or fiat currencies.
The precise cause of the Binance security breach remains under investigation. The exchange initially suspected that an employee’s laptop had been compromised. However, a Friday update indicated that investigators had discovered additional potential entry points. Binance added that it had found no evidence suggesting that wallet private keys were exposed.
To address the shortfall created by the theft, Binance said it had allocated more than $6.34 billion in corporate funds. Around $5 billion was already held in the affected cryptocurrencies, with the remaining assets being acquired through market purchases and privately arranged transactions.
Customer withdrawals remained temporarily suspended while the exchange continued its security assessments. Binance also announced that it intended to release updated proof-of-reserves figures on Monday, Nov. 2, showing its asset holdings and the backing of customer balances.
