The Binance Bitcoin hack has put the cryptocurrency exchange under fresh scrutiny after hackers stole 18,270 BTC, worth approximately $1.4 billion. The stolen Bitcoin exceeds Tesla’s disclosed holdings and is more than twice the amount held in El Salvador’s national Bitcoin reserve.
The incident, which took place on Thursday, October 29, has raised fresh concerns about cryptocurrency exchange security and the growing threat of state sponsored cyberattacks. Blockchain intelligence firm TRM Labs has linked the attack to TraderTraitor, a North Korean hacking group, with a high degree of confidence.
At the time of the reported theft, Bitcoin was trading at around $78,500 per coin. This puts the value of the stolen cryptocurrency at approximately $1.4 billion, making it one of the largest reported Bitcoin thefts in the industry’s history.
The scale of the incident is particularly striking when compared with the Bitcoin holdings of major companies and national governments.
Binance Bitcoin Theft Exceeds Tesla’s Holdings
The 18,270 BTC stolen from Binance is significantly higher than the Bitcoin holdings reported by several prominent organisations.
Tesla disclosed that it held 11,509 BTC as of September 30, according to its latest quarterly filing. El Salvador’s publicly reported Bitcoin reserve stood at approximately 7,820 BTC, based on figures published by its National Bitcoin Office.
In other words, the amount taken from Binance was around 1.6 times Tesla’s Bitcoin holdings and approximately 2.3 times El Salvador’s reserve.
The stolen amount was also close to SpaceX’s disclosed Bitcoin holdings of 18,712 BTC. The difference between the two figures was just 442 BTC.
Both Tesla and SpaceX reported their holdings as of September 30 in quarterly disclosures published during October.
These comparisons highlight the extraordinary scale of the breach. A single security incident resulted in the loss of more Bitcoin than several high profile corporate and government holdings.
El Salvador began purchasing Bitcoin in September 2021 as part of its broader cryptocurrency strategy. The country’s reserve has since become one of the most closely watched examples of government involvement in digital assets.
The Binance incident demonstrates how quickly a major security breach can involve amounts comparable to the reserves of entire countries.
North Korean Hacking Group Linked to the Attack
Investigators believe the attack may have been carried out by TraderTraitor, a North Korean state sponsored hacking group.
Blockchain intelligence company TRM Labs attributed the incident to the group with high confidence. However, Binance has not publicly confirmed the identity of the attacker.
TraderTraitor has previously been linked to major cryptocurrency thefts. The FBI also blamed the group for the February 2025 Bybit hack, in which approximately $1.5 billion was stolen.
The connection is significant because North Korean hacking operations have repeatedly targeted cryptocurrency platforms and digital asset businesses.
Such attacks can provide access to substantial financial resources, making cryptocurrency exchanges attractive targets.
According to the available transaction records, the stolen Bitcoin left a Binance hot wallet at approximately 4:20 p.m. ET on Thursday.
A hot wallet is an internet connected cryptocurrency wallet that exchanges use to process customer withdrawals and other transactions.
The funds were transferred to a newly created wallet address through 11 separate transactions, according to blockchain records cited in the original report.
The receiving address subsequently divided the stolen Bitcoin across 19 different addresses.
Seventeen of those addresses received exactly 1,000 BTC each. The remaining two received approximately 833 BTC and 438 BTC.
At the time of the initial investigation, none of the receiving addresses had spent the Bitcoin.
Splitting cryptocurrency across multiple wallets can make tracking and recovery more complicated, although blockchain transactions remain publicly visible.
Binance Moves to Recover the Stolen Funds
Following the incident, Binance and other cryptocurrency industry participants began efforts to prevent the stolen assets from moving through the wider digital asset ecosystem.
According to Binance, approximately $3 billion of the roughly $6.3 billion in stolen assets had been frozen onchain by Saturday morning in Asia.
Much of this recovery effort involved stablecoin issuers, including Tether and Circle.
Unlike Bitcoin, many stablecoins have administrative controls that allow their issuers to freeze tokens associated with specific wallet addresses.
These controls can help prevent stolen funds from being transferred or converted into other assets.
Bitcoin does not have an equivalent central authority capable of freezing individual coins. However, that does not mean stolen Bitcoin can move freely without restrictions.
Cryptocurrency exchanges and custodians can identify suspicious deposits and block transactions involving stolen funds when they reach their platforms.
This gives investigators another opportunity to intercept assets when attackers attempt to exchange Bitcoin for other cryptocurrencies or traditional currencies.
The recovery process therefore depends heavily on cooperation between exchanges, blockchain investigators, stablecoin issuers and law enforcement agencies.
While freezing digital assets can prevent some transfers, recovering Bitcoin already moved through multiple wallets remains a difficult challenge.
Binance Investigation Raises Questions About Internal Security
Binance’s explanation of the security breach is still developing.
The exchange’s initial investigation reportedly pointed towards a compromised engineer’s laptop. However, a subsequent update on Friday revealed that investigators had identified additional potential points of entry.
Binance also stated that it had found no evidence suggesting that wallet private keys had been leaked.
That distinction matters because private keys provide direct control over cryptocurrency stored in a wallet. A compromised private key can allow an attacker to transfer funds without the account holder’s permission.
If private keys were not exposed, investigators will need to establish how the attackers gained access to the systems or processes that enabled the transfers.
The incident also highlights the security challenges facing exchanges that manage large amounts of customer cryptocurrency through connected wallet infrastructure.
Binance said it had allocated more than $6.34 billion in company funds in response to the incident. This included approximately $5 billion already held in the affected cryptocurrencies.
The exchange was purchasing the remaining assets through open markets and privately negotiated transactions.
Meanwhile, withdrawals remained suspended while Binance carried out additional security checks.
The company also announced plans to publish updated proof of reserves on Monday, November 2. The report is expected to provide updated information about its cryptocurrency holdings and the assets backing customer balances.
Proof of reserves is an important transparency measure for cryptocurrency exchanges because it allows customers and external observers to assess whether reported assets support customer liabilities.
However, it does not automatically establish that an exchange’s entire security infrastructure is protected against future attacks.
For Binance, the next challenge will be demonstrating that the breach has been contained, strengthening its internal security systems and restoring customer confidence.
Follow TechBSB For More Updates
