North Korean-linked hackers stole 18,270 BTC from Binance, an amount valued at nearly $1.4 billion and larger than the Bitcoin holdings reported by Tesla and El Salvador. The stolen stash is also just 442 BTC short of SpaceX’s disclosed reserves, according to blockchain data and corporate filings.
At a Bitcoin price of approximately $78,500, the 18,270 BTC taken in the attack represents around $1.4 billion. The amount surpasses Tesla’s reported 11,509 BTC holdings and is more than twice El Salvador’s approximately 7,820 BTC reserve, based on wallet addresses published by the country’s National Bitcoin Office as of Friday.
SpaceX reported holding 18,712 BTC as of Sept. 30, leaving a difference of only 442 BTC compared with the amount stolen from Binance. Tesla and SpaceX disclosed their respective Bitcoin balances in quarterly filings released earlier this month.
El Salvador started purchasing Bitcoin in September 2021. The Binance exploit alone involved transfers equivalent to roughly 2.3 times the country’s current Bitcoin reserves, with the transactions confirmed within a single block.
Blockchain analytics company TRM Labs identified the attackers as TraderTraitor, a North Korean state-backed hacking group, with a high level of confidence. The same group was previously blamed by the FBI for the $1.5 billion Bybit breach in February 2025. Binance has not officially confirmed the identity of those responsible.
Stolen BTC distributed across multiple wallets
Blockchain records show that the Bitcoin began leaving Binance at around 4:20 p.m. ET on Thursday. An internet-connected hot wallet used by the exchange to facilitate customer withdrawals transferred the funds to a newly created address through 11 transactions, according to mempool.space data.
The receiving wallet then distributed the Bitcoin across 19 separate addresses. Seventeen wallets received 1,000 BTC apiece, while the remaining addresses received approximately 833 BTC and 438 BTC. All 19 wallets continued holding their balances as of 2:02 a.m. ET on Friday.
Binance expands recovery and security measures
By Saturday morning in Asia, Binance said it had successfully frozen approximately $3 billion of the estimated $6.3 billion stolen in the incident.
Stablecoin issuers Tether and Circle have played an important role in the freezing process. Their tokens include address-level restrictions that allow the companies to prevent funds from moving through designated wallets.
Cryptocurrency exchanges and custodial platforms can also intervene when stolen Bitcoin reaches their services. Such restrictions could help investigators recover additional assets if the attackers attempt to sell, exchange or cash out the funds.
The exchange’s investigation into the breach is still underway. Binance initially pointed to a potentially compromised laptop belonging to an engineer but later disclosed on Friday that investigators had identified other possible points of entry. The company added that there was no evidence indicating that wallet private keys had been exposed.
Binance also announced that it had allocated more than $6.34 billion in corporate funds to address the incident. Around $5 billion of that amount was already held in the cryptocurrencies affected by the theft, while the remaining assets were being acquired through market purchases and privately negotiated deals.
Withdrawals remained paused as the exchange carried out additional security checks. Binance said it expected to release updated proof-of-reserves information on Monday, Nov. 2, outlining its asset holdings and confirming the backing of customer deposits.
