Bitcoin Worth $1.4 Billion Taken From Binance Is Parked in 19 Addresses

Late Thursday, roughly 18,270 BTC, valued near $1.4 billion, was pulled out of a Binance hot wallet in eleven transfers. Minutes later the thief spread it across 19 fresh addresses using a peel chain, which trims a fixed amount off at every hop. Seventeen addresses hold 1,000 BTC apiece, with smaller leftovers in the other two. By early Friday morning nothing had moved, and the only activity came from strangers sending dust payments. Binance’s 2019 breach cost 7,000 BTC, so this one is far larger in coin terms.

Why Freezing Bitcoin Is So Difficult

Stablecoin issuers such as Tether and Circle could blacklist tokens quickly because they control the underlying contracts. Bitcoin has no central party with that power. Investigators mainly hope the thief tries to cash out through a trading venue, broker or swap service that will block the funds. Binance reports about $3 billion frozen against an estimated $6.3 billion in total impact.

Signs Pointing to Compromised Access

The transfers carried genuine signatures from Binance addresses and resembled routine customer payouts. Binance says an engineer’s infected laptop probably gave the attacker a foothold in its systems, and it has seen no evidence of leaked private keys.

North Korean Group Suspected

TRM Labs says it has high confidence the theft was carried out by TraderTraitor, a North Korean state hacking unit. After the Bybit heist in 2025, that group took roughly ten days to swap stolen ether for bitcoin, so analysts expect these coins to start moving soon.