Binance Bitcoin Theft Outpaces El Salvador’s Reserve by More Than 2x and Tops Tesla’s Holdings

The 18,270 BTC stolen from Binance is valued at approximately $1.4 billion, putting the amount just 442 BTC below SpaceX’s reported Bitcoin holdings. Blockchain intelligence investigators have linked the attack to North Korean hackers.

The North Korea-linked attackers stole more Bitcoin from Binance on Thursday than Tesla currently holds and more than twice the amount in El Salvador’s national Bitcoin reserves.

The stolen 18,270 BTC exceeds Tesla’s reported holdings of 11,509 BTC and is more than double the approximately 7,820 BTC held in wallets disclosed by El Salvador’s National Bitcoin Office as of Friday. Based on a Bitcoin price of $78,500, the stolen funds are worth around $1.4 billion.

The amount is also close to SpaceX’s reported 18,712 BTC holdings, falling short by just 442 coins. Both Tesla and SpaceX disclosed their Bitcoin positions as of Sept. 30 in quarterly filings released this month.

El Salvador started accumulating Bitcoin in September 2021. The Binance exploit transferred approximately 2.3 times the country’s current reserve in transactions recorded within a single block.

Blockchain analytics firm TRM Labs attributed the incident to TraderTraitor, a North Korean state-sponsored hacking group, with a high degree of confidence. The FBI previously identified the same group as responsible for the $1.5 billion Bybit hack in February 2025. Binance has yet to publicly identify the attackers.

How the stolen Bitcoin moved

The Bitcoin was transferred out of Binance at approximately 4:20 p.m. ET on Thursday. According to records from mempool.space, an exchange hot wallet, which is an internet-connected wallet used to process customer withdrawals, moved the funds to a newly created address through 11 separate transactions.

The destination wallet subsequently distributed the stolen Bitcoin across 19 different addresses. Seventeen of those wallets received exactly 1,000 BTC each, while the remaining two received approximately 833 BTC and 438 BTC. None of the addresses had moved its Bitcoin balance as of 2:02 a.m. ET on Friday.

Recovery efforts extend beyond asset freezes

By Saturday morning in Asia, Binance reported that approximately $3 billion of the roughly $6.3 billion stolen had been frozen onchain.

A significant portion of the recovery effort involves stablecoin issuers, including Tether and Circle. Both companies have mechanisms that allow them to restrict transactions involving specific wallet addresses, helping prevent the movement of funds.

Cryptocurrency exchanges and custodians can also block stolen Bitcoin when attackers transfer it to their platforms. This provides investigators with opportunities to identify and intercept the assets if hackers attempt to exchange or withdraw them.

Binance’s investigation into the security breach remains ongoing. The exchange initially suspected that an engineer’s laptop had been compromised. However, a subsequent update on Friday revealed that investigators had identified additional potential entry points. Binance also stated that it had found no indication that wallet private keys were exposed.

To address the stolen assets, Binance said it had allocated more than $6.34 billion in company funds. This includes approximately $5 billion already available in the cryptocurrencies affected by the incident. The exchange was sourcing the remaining assets through open-market purchases and privately negotiated transactions.

Customer withdrawals remained temporarily suspended while Binance continued its security reviews. The exchange also announced plans to release updated proof-of-reserves data on Monday, Nov. 2, detailing its asset holdings and demonstrating the backing of customer balances.