Binance Hacker Moves $1.4B in Bitcoin Across 19 Wallets Beyond Freezing

The attacker behind Thursday’s Binance breach distributed 18,270 stolen bitcoin across 19 separate wallets within minutes, with the funds remaining untouched since then, according to CoinDesk’s blockchain investigation.

A review of blockchain activity shows that 17 of the wallets contain exactly 1,000 BTC each. Another holds 832.5 BTC, while the remaining address contains 437.7 BTC. None of the 19 wallets has transferred any bitcoin since Thursday night.

At 20:20 UTC, Binance’s hot wallet transferred slightly more than 18,270 BTC to a single receiving address through 11 separate transactions. All 11 transfers were confirmed in block 973,732. Hot wallets are internet-connected storage systems that cryptocurrency exchanges use to process customer withdrawals.

At early Friday prices, the stolen bitcoin was worth approximately $1.4 billion. That amount is more than 2.5 times the 7,000 BTC stolen from Binance during its 2019 security breach, when Bitcoin was trading below $5,000.

The attacker began dividing the funds immediately after they reached the initial destination. The transactions used to distribute the bitcoin were also recorded in block 973,732, shortly after the original transfers.

CoinDesk tracked the movement of each transaction output through data from mempool.space. The attacker used a technique known as a peel chain, which involves sending a fixed amount of cryptocurrency to a newly generated wallet while forwarding the remaining balance to another address.

In this case, successive transactions separated 1,000 BTC at a time into fresh wallets. Some remaining balances were combined and divided again during the process. A final consolidation moved smaller leftover amounts into an address containing 832.5 BTC.

Around 28 minutes later, another transfer of 437.7 BTC reached the 19th wallet in block 973,738.

The distribution left 17 addresses holding precisely 1,000 BTC each, alongside one wallet containing 832.5 BTC and another with 437.7 BTC. By 04:23 UTC on Friday, none of these addresses had recorded an outgoing bitcoin transaction.

The only subsequent activity involved unsolicited dust deposits. Unknown users began sending small amounts of bitcoin, worth roughly a dollar or two, to the wallets late Thursday.

Bitcoin’s Decentralized Structure Makes Freezing Stolen Funds Difficult

The handling of the stolen bitcoin contrasts with the response possible for other assets taken during the breach.

Stablecoin issuers such as Tether, Circle and Ripple control the smart contracts governing their tokens. This gives them the ability to blacklist specific addresses and prevent attackers from moving funds. Several issuers can therefore restrict stolen stablecoins relatively quickly.

Bitcoin operates differently because it has no central issuer with the authority to freeze individual wallets. The stolen coins can generally be intercepted only if they reach a centralized exchange, an over-the-counter trading desk or a cryptocurrency swapping service willing to block the transactions.

Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking group, with a high degree of confidence.

The same group was linked to the $1.5 billion Bybit theft in February 2025. Following that attack, the hackers spent approximately 10 days converting stolen ether into bitcoin.

Binance Transfers Resembled Standard Customer Withdrawals

An examination of the 11 original transactions indicates that each followed the structure of a typical Binance withdrawal.

One transaction, for example, included 18 separate bitcoin inputs from an address identified as belonging to Binance by blockchain tracker Whale Alert. The funds were sent to the attacker, while the remaining change was returned to a Binance-controlled address.

All 11 transactions carried valid signatures from bitcoin addresses controlled by Binance.

In a post published on X on Monday, Binance said its preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer. The attacker allegedly used the device to gain access to a service container, which then enabled unauthorized withdrawal requests.

The exchange added that investigators had found no evidence that private keys belonging to its wallets had been exposed.

Binance estimates the total financial damage from the incident at approximately $6.3 billion and has promised to compensate all affected users. Deposits and withdrawals remain suspended as the exchange continues responding to the breach.

About The Author

ctleditor

See author's posts