Mentioned in This Article
1. What happened in the Binance bitcoin theft?
Attackers drained 18,270 bitcoin (BTC) from Binance on Thursday, October 29, 2026, a haul valued at roughly $1.4 billion at a price of $78,500 per coin. Blockchain analytics firm TRM Labs attributes the operation to North Korea's TraderTraitor unit with high confidence, making it the latest entry in a long run of North Korea crypto hack cases. Binance has not publicly identified who was behind the breach.
The stolen bitcoin is only one slice of a larger loss. Across all the cryptocurrencies taken, the total is estimated at about $6.3 billion, and the exchange says roughly $3 billion of that has been frozen on-chain. Withdrawals on the platform remain suspended while security checks continue.
2. How the stolen coins compare with corporate and national holdings
Measured by size, the bitcoin that left Binance is larger than the position Tesla reports. The electric-vehicle maker holds 11,509 BTC, so the stolen amount exceeds it by a wide margin. El Salvador's strategic reserve, which the National Bitcoin Office publishes as of Friday, stands at about 7,820 BTC across its reserve wallets. The attacker therefore moved roughly 2.3 times what the country has accumulated since it began buying bitcoin in September 2021.
The closest comparison is SpaceX, which disclosed 18,712 BTC. The stolen total sits just 442 BTC below that figure. Both Tesla and SpaceX reported their holdings as of September 30 in quarterly filings released earlier this month, so the comparison uses the most recent public numbers rather than live balances.
These comparisons are useful mainly as a sense of scale. A single actor shifted an amount of bitcoin that took a national government years to gather, and did so in transfers that were confirmed within one block of the network.
3. Timeline of the transfers on the bitcoin network
The coins left Binance at around 4:20 p.m. Eastern Time on Thursday. According to records on the mempool.space explorer, a hot wallet sent them to a newly created address in 11 transactions. A hot wallet is an internet-connected account that an exchange uses to process customer withdrawals, which makes it more convenient than offline storage but also more exposed to attack.
The receiving address did not hold the funds for long. It divided them among 19 addresses: seventeen of them contain exactly 1,000 BTC each, while the other two hold about 833 BTC and 438 BTC. As of 2:02 a.m. Eastern Time on Friday, none of those 19 addresses had moved any coins.
The tidy 1,000 BTC splits are notable because they suggest a deliberate plan to spread the proceeds before any attempt to convert them. Investigators typically watch such wallets closely, since any later movement can show where the funds are heading.
4. Who is TraderTraitor and why does the attribution matter?
TraderTraitor is the name given to a North Korean state-sponsored hacking unit. TRM Labs says it assigns the Binance attack to this group with high confidence, a phrase analysts use when the technical evidence, such as wallet behavior and laundering patterns, closely matches earlier operations. An earlier report had pointed to the Lazarus Group, the broader label commonly applied to North Korean cyber actors.
The same group was blamed by the FBI for the $1.5 billion theft from the exchange Bybit in February 2025. If the attribution holds, one state-backed team would be linked to two of the largest thefts the industry has recorded.
The attribution remains an assessment from a private analytics company. Binance itself has not named the attacker, and no government statement has confirmed the finding in the material available so far.
5. What is Binance doing about the stolen funds?
Binance says it has frozen about $3 billion of the roughly $6.3 billion stolen, as of Saturday morning in Asia. Much of that comes from stablecoin issuers such as Tether and Circle, whose tokens carry built-in controls that let the issuer block transfers from particular addresses.
Exchanges and custodians can contribute as well. If stolen bitcoin is deposited with a platform that cooperates with investigators, that platform can refuse to process it. This gives law enforcement and security firms a chance to intercept funds at the moment the attacker tries to cash out, which is usually the most vulnerable step in any laundering effort.
Bitcoin itself has no issuer who can freeze it, which is why the 19 addresses holding the stolen BTC are harder to neutralize than the frozen stablecoin balances. Recovery of that portion depends on the attackers making a mistake or on exchanges blocking the coins when they surface.
6. Changing explanations of how the breach occurred
Binance's account of the intrusion has shifted as its investigation progressed. The first findings pointed to a compromised laptop belonging to an engineer. An update released on Friday identified additional points of compromise, which suggests the attackers had more than one way into the exchange's systems.
The company says it has found no evidence that private keys for its wallets were leaked. That distinction matters: if keys had been exposed, the exchange would need to move every affected balance to new wallets, while an attack on access systems or internal tools can be contained differently.
Binance has not yet published a full technical post-mortem, and the details of how the attackers reached the hot wallet remain unspecified.
7. Compensation plan and customer protections
To cover the losses, Binance has set aside more than $6.34 billion in company funds. About $5 billion of that is already held in the cryptocurrencies that were taken. The exchange is acquiring the remaining assets through open-market purchases and privately negotiated trades, a method that avoids buying everything at once on public order books.
Holding reserves in the same assets that were stolen allows a platform to make customers whole in kind rather than only in cash value. Withdrawals stay suspended during the security checks, so customers cannot yet move assets off the platform.
8. Why hot wallets remain a target for exchanges
Every large exchange has to balance convenience against safety. Cold storage keeps keys offline and is considered far harder to breach, but it cannot serve a customer who wants to withdraw funds within minutes. Hot wallets fill that gap by holding a working balance that is permanently connected to the internet and to the exchange's own systems.
That connection is what attackers aim for. A compromised employee device, a stolen credential or a flaw in internal tooling can give an intruder a path toward the systems that authorize withdrawals. Security teams respond with transaction limits, multi-party approvals and monitoring, yet the size of this theft shows how much value can sit behind those controls at a major platform.
The scale also illustrates why exchanges are asked to keep the hot wallet share of customer assets small. A larger share online means a larger prize for a successful intrusion, and a single compromised path can expose a great deal at once.
9. How stablecoin freezes and exchange blocks work
The frozen portion of this theft depends on a feature that bitcoin lacks. Tokens issued by Tether and Circle are controlled by smart contracts that the issuers can update to blacklist an address. Once an address is blacklisted, tokens held there cannot be transferred, which turns a stolen balance into something the thief cannot spend.
Exchanges and custodians use a different method. They screen incoming deposits against lists of addresses linked to theft, and they can hold or reject funds that match. Because most attackers eventually need to convert stolen assets into cash or into other currencies, these chokepoints give investigators their best chance of recovery.
Attackers know this, which is why they often split proceeds across many addresses, as happened here with the 19 wallets, and then move funds gradually through intermediaries. Blockchain analytics firms such as TRM Labs trace those hops and share their findings with exchanges and law enforcement so that the funds can be flagged along the way.
10. What comes next for Binance and its users
Proof of reserves is a disclosure in which an exchange demonstrates that the assets it controls are at least equal to what it owes customers. The exercise usually combines on-chain evidence of wallet balances with a record of customer liabilities, so outside observers can compare the two sides.
After a theft of this size, the report takes on added weight. Users want to know whether the exchange remains fully backed once the stolen assets are subtracted and the compensation fund is counted. The update scheduled for November 2 is therefore likely to be the first independent-style check of how much the incident has changed Binance's balance sheet.
A report of this kind has limits. It reflects a snapshot at a point in time and depends on the method used to verify liabilities, so analysts will examine the methodology as closely as the headline totals.
The next scheduled milestone is Monday, November 2, when Binance plans to publish updated proof-of-reserves results. Such a report lays out the exchange's holdings and shows how they back customer balances, and it will be read closely by users and analysts looking for evidence that the compensation fund is sufficient.
Other open questions include when withdrawals will resume, whether the 19 addresses holding the stolen bitcoin will move, and whether Binance will confirm or dispute the North Korean attribution. Movement from those addresses would give investigators fresh data, and any attempt to sell or mix the coins would test how many venues are ready to block them.