Binance Hack of 18,270 BTC Remains Unresolved
The loot has been spread across 19 wallets and remains out of reach; unlike stablecoins, Bitcoin cannot be frozen. Binance is still keeping deposits and withdrawals paused.
Key Takeaways
- The attacker moved 18,270 stolen Bitcoin across 19 wallets within minutes and then left the coins untouched.
- The haul was worth about $1.4 billion (€1.3 billion) at the time of the attack, while Binance says the total damage has climbed to $6.3 billion.
- Bitcoin addresses cannot be frozen; TRM Labs links the theft with high confidence to the North Korean group TraderTraitor.
The attacker who hit Binance on Thursday evening split 18,270 stolen Bitcoin across 19 wallets within minutes and has not moved them since. The coins were worth about $1.4 billion (€1.3 billion) at the time of the attack. Binance now says the total damage has climbed to $6.3 billion and that deposits and withdrawals are still paused.
How the Coins Were Split Up
According to blockchain data, Binance sent a little over 18,270 BTC from a hot wallet to one address at 20:20 UTC, spread across 11 transactions that were all confirmed in block 973,732. A hot wallet is the online wallet a crypto exchange uses to make payouts to customers.
That was followed by a so-called peel chain. In this setup, 1,000 BTC is split off to a new address each time, while the remainder moves on to the next step. Some of the leftover amounts were then combined again and split up once more. In the end, a final sweep landed in a wallet with 832.5 BTC, and 28 minutes later another 437.7 BTC followed in a 19th address.
No Freeze Possible
The 19 wallets have not been used since Thursday evening. They are getting small spam deposits from unknown senders, worth about a dollar or two each time. That does not change the main point: Bitcoin has no issuer that can blacklist or freeze the addresses.
That is what makes it different from stablecoins. Tether, Circle, and Ripple can adjust the contracts behind their tokens and block addresses. With Bitcoin, that only becomes possible if the coins end up at a crypto exchange, an OTC desk, or a swap service.
Why This Matters
For European crypto investors, this case shows how quickly large amounts can move on the blockchain and how limited direct intervention is with Bitcoin. The incident also highlights why security around hot wallets and employee access rights remains so important for crypto exchanges. TRM Labs linked the theft with high confidence to TraderTraitor, a North Korean hacking group that has also been tied to major crypto thefts before, including the $1.5 billion (€1.3 billion) Bybit hack in February 2025.
