The hacker responsible for Thursday’s Binance security breach divided 18,270 stolen BTC into 19 different wallets within minutes of receiving the funds. None of the bitcoin has moved since the transfers were completed, according to CoinDesk’s analysis of blockchain records.
The investigation found that 17 addresses contain exactly 1,000 BTC apiece. One additional wallet holds 832.5 BTC, while the final address contains 437.7 BTC. All 19 wallets have remained inactive since Thursday night.
The initial movement began at 20:20 UTC, when Binance’s hot wallet transferred more than 18,270 BTC to a single destination through 11 transactions. Every transfer was included in block 973,732.
Hot wallets are connected to the internet and are commonly used by cryptocurrency exchanges to handle customer withdrawals. At prices recorded early Friday, the transferred bitcoin was worth approximately $1.4 billion. This represents more than 2.5 times the 7,000 BTC stolen from Binance in its 2019 hack, when Bitcoin traded below $5,000.
The attacker started redistributing the funds almost immediately after receiving them. The transactions responsible for splitting the bitcoin were confirmed in the same block as the original transfers.
Using data from mempool.space, CoinDesk traced the transaction outputs and identified a method known as a peel chain. Under this approach, a transaction sends a specific amount to a new wallet and forwards the remaining balance to another address, allowing the process to continue through multiple transactions.
The attacker repeatedly separated 1,000 BTC into fresh addresses. Some smaller balances were later combined before being divided again. The final consolidation gathered the remaining irregular amounts into a wallet containing 832.5 BTC.
A further transfer occurred 28 minutes later in block 973,738, sending 437.7 BTC to the 19th address.
The resulting distribution consists of 17 wallets with 1,000 BTC each, one holding 832.5 BTC and another containing 437.7 BTC. By 04:23 UTC Friday, blockchain records showed no outgoing transactions from any of the addresses.
Since then, the only additional activity has involved small unsolicited deposits. Unknown senders have transferred tiny amounts of bitcoin, typically worth a dollar or two, to the wallets since late Thursday.
Bitcoin Funds Cannot Be Frozen Like Stolen Stablecoins
The stolen bitcoin presents a different challenge from the other assets involved in the breach. Stablecoin issuers, including Tether, Circle and Ripple, maintain control over the smart contracts governing their tokens. They can use that authority to blacklist addresses and prevent funds from being transferred.
Bitcoin does not have a central issuer capable of freezing individual wallets. As a result, the stolen BTC can generally be blocked only when it reaches a centralized exchange, an over-the-counter trading platform or a cryptocurrency swap service that agrees to restrict the funds.
Blockchain analytics firm TRM Labs identified North Korea’s TraderTraitor hacking group as the likely attacker, expressing a high level of confidence in the attribution.
TraderTraitor was also linked to the $1.5 billion Bybit hack in February 2025. Following that theft, the group reportedly spent around 10 days converting the stolen ether into bitcoin.
Binance Withdrawals Carried Valid Transaction Signatures
An analysis of the 11 transfers found that their structure closely resembled routine customer withdrawals processed by Binance.
One of the transactions included 18 bitcoin inputs from an address that blockchain tracking service Whale Alert identifies as belonging to Binance. The funds were sent to the attacker’s destination, while the remaining change was returned to a Binance address.
All 11 transactions contained valid signatures generated by bitcoin addresses under Binance’s control.
Binance previously explained in an October 26 post on X that its initial investigation pointed to a compromised laptop belonging to a DevOps engineer. According to the exchange, the attacker used the device to access a service container and submit unauthorized withdrawal requests.
The company also said it had found no indication that private keys associated with its wallets had been leaked.
Binance estimates the total losses from the incident at approximately $6.3 billion and has committed to covering the affected funds. Deposits and withdrawals remain suspended while the exchange continues its investigation and response efforts.
