coindesk.com
The attacker who drained Binance late on Thursday broke 18,270 stolen bitcoin $BTC$78,436.48 into 19 separate piles within minutes, then left them alone.
At 20:20 UTC, Binance’s hot wallet sent just over 18,270 $BTC to one address in 11 transactions, all confirmed in block 973,732. A hot wallet is the internet-connected wallet an exchange uses to pay out customer withdrawals. The coins were worth about $1.4 billion at early Friday prices, or more than two and a half times the 7,000 $BTC Binance lost in its 2019 hack (though bitcoin traded under $5,000 at the time).
The transactions that split the coins up were confirmed in block 973,732 too, right after the deposits into the receiving address.
CoinDesk followed every output using mempool.space data. The coins went through a so-called peel chain, where each transaction carves 1,000 $BTC off into a fresh address and passes the rest to the next hop.
Some leftovers were merged back together and split again. One last sweep gathered the odd amounts into a wallet holding 832.5 $BTC.
Twenty-eight minutes later, in block 973,738, a final 437.7 $BTC landed in a 19th address.
Seventeen wallets now hold exactly 1,000 $BTC each, one holds 832.5 $BTC and one holds 437.7 $BTC. As of 04:23 UTC Friday, none of the 19 had sent a single coin.
The only new activity is spam, as strangers have been sending the wallets tiny deposits worth a dollar or two since late Thursday.
The rest of the haul has gone very differently. Tether, Circle, Ripple and other stablecoin issuers control the contracts behind their tokens, so they could blacklist the attacker’s addresses within hours.
Bitcoin has no issuer to do that, so the coins can only be stopped once they reach an exchange, an over-the-counter desk or a swap service.
TRM Labs attributed the theft to TraderTraitor, North Korea’s elite hacking unit, with “high confidence.” After the $1.5 billion Bybit theft in February 2025, the same unit spent about 10 days turning stolen ether into bitcoin.
Ordinary withdrawals
Each of the 11 transfers is built like an ordinary Binance withdrawal. In one of them, 18 chunks of bitcoin from an address that blockchain tracker Whale Alert labels as “Binance” go out to the attacker, and the change comes back to Binance.
Every transfer carried a valid signature from Binance-controlled bitcoin addresses.
In an X post on Monday, Binance said its initial investigation suggests a compromised laptop belonging to a DevOps engineer gave the attacker access to a service container, which was then used to submit unauthorized withdrawals. It added there was no evidence that any wallet’s private key leaked.
