Binance Hacker’s Bitcoin Haul Surpasses Coinbase Corporate Holdings

Attackers behind the reported $6.3 billion Binance hack accumulated 18,270 Bitcoin, worth roughly $1.4 billion, according to blockchain analytics firm Bitquery. The haul surpassed Coinbase’s combined corporate holdings of 18,071 BTC as of Sept. 30, comprising 17,954 BTC held for investment and 117 BTC reserved for operations—a difference of 199 BTC. Coinbase’s figure excludes Bitcoin held on behalf of customers.

Bitquery linked the Bitcoin to 19 addresses controlled by the attackers, including 17 wallets containing 1,000 BTC each. The coins were stolen from Binance hot wallets during a breach that affected nine blockchains in less than four hours. Binance said approximately $3 billion in stolen assets had been frozen and pledged to cover user losses. TRM Labs attributed the attack to North Korea’s TraderTraitor hacking group.

The attackers also held 508,621 Ether, according to Bitquery, exceeding the 495,362 ETH attributed to The Ether Machine, the third-largest corporate Ether holder tracked by BitcoinTreasuries.net. Although the original theft included 200,630 ETH, the balance grew as the attackers swapped stolen stablecoins and other tokens for additional Ether.

Binance investigators reportedly found additional breach points after initially suspecting that a DevOps engineer’s laptop had been compromised. The widening attack surface highlights the scale of the incident and Binance’s continuing efforts to secure affected assets and identify those responsible for the theft.