Binance Hack: $1.4B in Bitcoin Split Across 19 Wallets

Summary of the Binance Hot-Wallet Breach

Late Thursday, attackers siphoned more than 18,270 BTC from a Binance hot wallet, immediately redistributing the stolen coins into 19 separate addresses. The transfers were confirmed in block 973,732 and, within minutes, the funds were split using a peeling technique so that most recipient wallets now hold sizable but non-blockable balances. Based on early Friday prices, the stolen Bitcoin was worth roughly $1.4 billion — a loss far exceeding Binance’s 2019 breach.

How the Theft Unfolded on-Chain

According to on-chain records, the hot wallet outflows occurred in 11 outgoing transactions that converged to a single destination address in block 973,732. Immediately afterward, the attacker moved the coins through a Peel Chain pattern, where repeated transactions send fixed amounts (commonly 1,000 BTC) to new addresses while returning a remainder to the next hop. This technique is frequently used to obfuscate provenance and complicate traceability.

Final Distribution Details

The splitting resulted in 17 wallets each holding exactly 1,000 BTC, one wallet containing 832.5 BTC, and a final wallet with 437.7 BTC. An aggregation transaction collected residual irregular amounts into a wallet with 832.5 BTC, and the last tranche (437.7 BTC) landed in block 973,738 about 28 minutes later. As of 04:23 UTC Friday, none of these 19 wallets had forwarded a single satoshi onward.

Attribution and Prior Activity

Blockchain security firm TRM Labs has attributed the breach to TraderTraitor, an elite hacking unit linked to North Korea. TRM pointed to behavioral patterns consistent with the group’s previous operations, including their February 2025 attack on Bybit, where they reportedly spent roughly ten days converting stolen Ethereum into Bitcoin. On-chain heuristics, timing, and wallet behavior often support such attributions but do not provide definitive country-level proof.

Binance’s Initial Forensics and Response

Binance posted an initial incident update on X (formerly Twitter), saying their preliminary investigation indicates a compromised DevOps engineer laptop. The attacker reportedly gained access to a service container and issued unauthorized withdrawal requests from that environment. Binance emphasized there is no evidence that private keys for the affected wallets were exposed, a crucial distinction since key leakage would broadly endanger custodial assets.

Impact to Users and Platform Operations

Binance has estimated the total damage from the incident at $6.3 billion and pledged to make affected customers whole. In the meantime, deposits and withdrawals on the exchange remain suspended as the team continues forensic work and coordinates with law enforcement and chain-analysis partners. The market reacted to the breach: Bitcoin slipped from intraday highs above $81,000 to roughly $78,000 after the news, reflecting short-term volatility tied to major exchange hacks.

Security, Traceability, and the Limits of Freezing Funds

Because the stolen coins were moved into externally accessible wallets that do not belong to centralized custodians, they are effectively non-freezable by exchanges — though some jurisdictions and custodial services can refuse to process tainted funds. On-chain analytics firms and sanctions-screening providers will monitor these addresses for potential cash-out attempts across mixers, OTC desks, or centralized exchanges that might accept the coins. However, peel chains and similar laundering patterns increase the time and complexity required to trace flows and recover assets.

What This Means for Crypto Security

This breach underscores persistent operational risk in cryptocurrency custody: hot wallets and the endpoints used to manage them (workstations, engineer laptops, and containers) are high-value targets. Exchanges and institutional crypto holders should double down on multi-layered defenses: hardware-based key management, strong endpoint protection, zero-trust access to DevOps environments, multi-signature withdrawal controls, and robust on-chain monitoring. For traders and investors, the incident is a reminder that exchange custodial risk remains a factor despite advances in blockchain security tooling.

Blockchain investigators will continue to track the 19 addresses and any downstream movement. As Binance pursues remediation and reimbursement, the wider crypto ecosystem watches closely for follow-up disclosures, law-enforcement cooperation, and any attempts to liquidate the stolen Bitcoin.