Binance Hackers Stole More Bitcoin Than Tesla Holds: 18,270 BTC Worth $1.4 Billion

Hackers took 18,270 bitcoin from Binance on Thursday, worth roughly $1.4 billion at $78,500 per coin. That is more than Tesla’s 11,509 BTC and over twice the 7,820 BTC held in El Salvador’s national reserve wallets, and it sits within 442 coins of SpaceX’s 18,712 BTC. Both companies disclosed their holdings as of Sept. 30 in quarterly filings. El Salvador began buying bitcoin in September 2021, and the attacker took about 2.3 times its reserve in transfers confirmed in a single block.

How the Bitcoin Left Binance

The coins left a hot wallet at about 4:20 p.m. ET Thursday, sent to a new address in 11 transactions, based on mempool.space records. That address then split the funds among 19 wallets. Seventeen hold exactly 1,000 BTC each, while the other two hold about 833 BTC and 438 BTC. None had spent its coins as of 2:02 a.m. ET Friday.

North Korea Link and TraderTraitor

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state sponsored hacking unit. The FBI blamed the same group for the $1.5 billion Bybit theft in February 2025. Binance has not named the attacker.

Frozen Funds and Binance’s Recovery Plan

Binance says roughly $3 billion of the $6.3 billion stolen has been frozen onchain, mostly by stablecoin issuers like Tether and Circle that can block transfers. Bitcoin cannot be frozen that way, but exchanges and custodians can block stolen coins deposited with them. Binance has set aside more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, and is buying the rest through markets and private trades. It found additional breach points beyond the suspected engineer laptop but no evidence that private keys leaked. Withdrawals remain suspended, and updated proof of reserves is due Monday, Nov. 2.