Binance hacker parks $1.4B in bitcoin across 19 wallets — and sits on it

Someone drained about 18,270 bitcoin from Binance late Thursday, worth roughly $1.4 billion at Friday's prices, then broke it into 19 piles within minutes and left it untouched. A CoinDesk trace of the blockchain puts 1,000 BTC in each of 17 wallets, 832.5 BTC in another and 437.7 BTC in the last. As of 04:23 UTC Friday, none of the 19 had moved a coin.

The mechanics, per CoinDesk's read of mempool.space data: at 20:20 UTC, a Binance hot wallet sent just over 18,270 BTC to a single address in 11 transactions, all confirmed in block 973,732. Each transfer was built like an ordinary Binance withdrawal, carried a valid signature from Binance-controlled addresses, and routed change back to Binance. The attacker then ran the funds through a "peel chain" — each transaction shaving 1,000 BTC off to a fresh address and passing the rest along — merging and re-splitting the odd remainders. Twenty-eight minutes later, in block 973,738, a final 437.7 BTC landed in the 19th address.

Binance said Monday on X that its initial investigation points to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container used to submit the unauthorized withdrawals. It added there was no evidence any wallet's private key leaked. Binance puts total losses from the attack at $6.3 billion — of which the $1.4 billion in bitcoin is one slice — and has pledged to cover them. Deposits and withdrawals remain suspended.

Blockchain-intelligence firm TRM Labs attributed the theft to TraderTraitor, North Korea's elite hacking unit, with "high confidence."

Key facts

• 18,270 BTC ($1.4 billion at Friday prices) stolen, split into 19 wallets — CoinDesk blockchain trace via mempool.space.
• 11 transfers from Binance's hot wallet confirmed in block 973,732; final 437.7 BTC in block 973,738 — CoinDesk trace.
• No funds moved from any of the 19 wallets as of 04:23 UTC Friday — CoinDesk trace.
• Total losses put at $6.3 billion; Binance pledges to cover them; deposits/withdrawals suspended — Binance X post.
• Entry point: compromised DevOps engineer's laptop; no key leak found — Binance X post.
• Theft attributed to North Korea's TraderTraitor with "high confidence" — TRM Labs.

The real-world read

Why the hacker is sitting still is the whole story. Stablecoin issuers — Tether, Circle, Ripple — control their token contracts and can blacklist addresses within hours. Bitcoin has no issuer to freeze anything, so these coins can only be stopped once they hit an exchange, OTC desk or swap service. The patience fits the attribution: after the February 2025 Bybit theft, the same TraderTraitor unit spent roughly 10 days converting stolen ether to bitcoin before cashing out, per CoinDesk.

Two cautions. The $6.3 billion headline figure and the compromised-laptop account both come from Binance, an interested party still investigating its own breach; the on-chain $1.4 billion in bitcoin is independently verifiable, the rest is not yet. And TRM's attribution, while stated with "high confidence," is one firm's analysis, not a confirmed finding.

Opinion, and whose

• TRM Labs: attributes the theft to North Korea's TraderTraitor with "high confidence."
• Binance: characterizes the entry point as a compromised employee laptop and says no private key leaked — its own preliminary finding.

Sources

• CoinDesk (Tier 2, secondary) — blockchain trace of the 19 wallets via mempool.space data, block numbers, transaction structure, loss figures, and the Bybit precedent. Cites Binance's X post and TRM Labs for attribution.
• Binance (via its X post, relayed by CoinDesk) — loss total, cause, and remediation pledge; an interested party describing its own breach.
• TRM Labs (via CoinDesk) — attribution to North Korea's TraderTraitor.

This is news reporting, not financial or security advice.