North Korean-linked hackers stole 18,270 BTC from Binance on Thursday, an amount that exceeds Tesla’s Bitcoin holdings and is more than twice El Salvador’s national reserve.
The stolen coins are valued at approximately $1.4 billion, based on a Bitcoin price of $78,500. The total also falls just 442 BTC short of SpaceX’s reported holdings.
The 18,270 BTC taken from Binance compares with Tesla’s 11,509 BTC and approximately 7,820 BTC held in reserve wallets disclosed by El Salvador’s National Bitcoin Office as of Friday.
SpaceX reported holding 18,712 BTC in its latest quarterly filings, which, like Tesla’s disclosures, reflected balances as of Sept. 30 and were published this month.
El Salvador started accumulating Bitcoin in September 2021. The amount stolen from Binance represents roughly 2.3 times the country’s current reserve, with the transactions confirmed in a single blockchain block.
Blockchain intelligence company TRM Labs attributed the incident to TraderTraitor, a North Korean state-backed hacking group, with what it described as high confidence. The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025. Binance has yet to publicly identify the attacker.
How the Bitcoin Was Moved
The stolen Bitcoin left Binance at approximately 4:20 p.m. ET on Thursday. According to records from mempool.space, an exchange hot wallet, which is an internet-connected account used to process customer withdrawals, transferred the funds to a newly created address through 11 separate transactions.
The receiving wallet subsequently distributed the Bitcoin across 19 different addresses. Seventeen addresses received exactly 1,000 BTC each, while the remaining two contained approximately 833 BTC and 438 BTC.
None of the receiving addresses had moved their Bitcoin as of 2:02 a.m. ET on Friday.
Recovery Efforts Extend Beyond Freeze Orders
By Saturday morning in Asia, Binance reported that approximately $3 billion of the estimated $6.3 billion stolen had been frozen onchain.
A significant portion of the frozen assets involved stablecoin issuers, including Tether and Circle. Their dollar-pegged tokens include mechanisms that allow the companies to restrict transactions involving specific wallet addresses.
Cryptocurrency exchanges and custodians also have the ability to block stolen Bitcoin deposited on their platforms. This provides investigators with opportunities to intercept funds if hackers attempt to exchange or withdraw the assets.
Binance’s investigation into the security breach remains ongoing. Its initial findings suggested that an engineer’s laptop had been compromised. However, an update released Friday revealed that investigators had identified additional points of entry.
The exchange also said it had found no evidence that wallet private keys were exposed during the incident.
To address the financial impact, Binance said it had allocated more than $6.34 billion in corporate funds. This included approximately $5 billion in cryptocurrencies already held by the company that were affected by the theft.
The remaining assets were being acquired through open-market purchases and privately negotiated transactions.
Meanwhile, Binance kept withdrawals suspended while security reviews continued. The exchange said it expected to release updated proof-of-reserves results on Monday, Nov. 2, outlining its asset holdings and demonstrating the backing of customer balances.
About The Author
More Stories
Nasdaq-Listed Firm Considers $450M Bitcoin Sale Amid Binance Hack and Quantum Fears
Binance Hack Triggers $1.57B in Crypto Liquidations as Bitcoin and Ether Slide
Strategy CFO Andrew Kang Steps Down After Record Operating Profit