$1.4B Bitcoin Stash From Binance Hack Scattered Across 19 Wallets

The attacker behind the Binance security breach has divided 18,270 stolen BTC among 19 separate wallets, completing the redistribution within minutes. A CoinDesk investigation of blockchain transactions found that all the funds remain in place, with no outgoing transfers recorded since Thursday night.

According to the analysis, 17 of the wallets hold exactly 1,000 BTC each. The remaining two contain 832.5 BTC and 437.7 BTC, respectively.

The first movement occurred at 20:20 UTC on Thursday, when Binance’s hot wallet transferred slightly more than 18,270 BTC to a receiving address through 11 transactions. All 11 transfers were confirmed in block 973,732.

At early Friday prices, the stolen bitcoin was worth approximately $1.4 billion. This is more than 2.5 times the 7,000 BTC lost in Binance’s 2019 hack, when Bitcoin was trading below $5,000.

The attacker started separating the funds almost immediately after receiving them. The redistribution transactions were included in the same block as the initial transfers.

Using mempool.space data, CoinDesk followed each transaction output and identified a process known as a peel chain. This technique involves transferring a fixed amount of bitcoin to a newly created wallet while sending the remaining balance to another address.

The attacker repeatedly used this approach to move 1,000 BTC into fresh wallets. Some smaller balances were later combined and divided again. The final consolidation gathered the remaining irregular amounts into an address containing 832.5 BTC.

A final transfer took place 28 minutes later, when 437.7 BTC reached the 19th wallet in block 973,738.

The distribution left 17 addresses holding 1,000 BTC each, one containing 832.5 BTC and another holding 437.7 BTC. By 04:23 UTC Friday, none of the 19 wallets had transferred any funds elsewhere.

Since the redistribution, the only additional activity has involved unsolicited dust transactions. Unknown users have sent tiny bitcoin deposits worth approximately $1 or $2 to the addresses since Thursday night.

Bitcoin’s Decentralized Network Makes Asset Freezing Difficult

The movement of the stolen BTC highlights why Bitcoin is harder to freeze than stablecoins.

Tether, Circle, Ripple and other stablecoin issuers control the smart contracts behind their tokens. They can blacklist specific addresses and prevent those wallets from transferring their assets.

Bitcoin has no central issuer with the authority to block individual addresses. This means the stolen coins can generally be intercepted only if they reach a centralized exchange, an over-the-counter trading desk or a cryptocurrency swap service willing to restrict them.

Blockchain analytics company TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with high confidence.

The group was previously linked to the February 2025 Bybit hack, which resulted in approximately $1.5 billion in stolen funds. Following that incident, the attackers reportedly spent around 10 days converting stolen ether into bitcoin.

Binance Points to Compromised DevOps Laptop

The 11 original transactions followed a structure similar to standard withdrawals processed through Binance.

One transfer involved 18 separate bitcoin inputs from an address that blockchain tracker Whale Alert identifies as belonging to Binance. The attacker received the funds, while the remaining change was returned to an address controlled by the exchange.

All 11 transfers carried valid signatures from Binance-controlled bitcoin addresses.

In a post on X on Monday, Binance said its initial investigation indicated that a compromised laptop belonging to a DevOps engineer may have provided the attacker with access to a service container. The attacker allegedly used that access to submit unauthorized withdrawal requests.

The exchange added that it had found no evidence that private keys associated with its wallets had been exposed.

Binance estimates the total damage from the incident at $6.3 billion and has promised to compensate all affected users. Deposits and withdrawals remain suspended as the exchange continues its response to the breach.