Key Notes
- CoinDesk traced roughly 18,270 stolen BTC into 19 addresses, with no onward transfers reported as of 04:23 UTC on October 30.
- Bitcoin has no issuer-operated freeze function, but custodial restrictions and potential seizure remain possible.
- Binance pledges to cover all losses while withdrawals remain paused and deposits operate normally.
The attacker behind the Binance hack divided roughly 18,270 stolen bitcoin, valued at around $1.4 billion at early Friday prices, among 19 addresses, according to a blockchain trace reported by CoinDesk. The Bitcoin portion presents a different recovery challenge from stablecoins that issuers can freeze.
Those coins form part of the incident covered in our report on Binance’s $6.3 billion loss estimate and coverage pledge. They are not an additional $1.4 billion on top of that estimate, and their dollar value changes with Bitcoin’s price.
Seventeen Addresses Hold 1,000 BTC Each
CoinDesk’s reconstruction identifies the following distribution of the stolen principal, using rounded amounts:
- Seventeen addresses holding 1,000 BTC each.
- One address holding approximately 832.5 BTC.
- One address holding approximately 437.7 BTC.
The publication says none of those 19 addresses had sent coins onward as of 04:23 UTC on October 30. That is the report’s observation time, rather than a claim that the balances will remain unchanged. Small unsolicited deposits from unrelated senders can also alter an address’s displayed balance without showing that the attacker moved its principal.
The receiving address’s public record shows 11 incoming credits totaling approximately 18,270.2 BTC. A referenced withdrawal transaction was confirmed in block 973,732 and combined 18 inputs, sending funds to the receiving address and returning change to a separate address.
CoinDesk describes a peel chain: successive transactions sent 1,000-BTC portions to fresh addresses while passing the remainder onward. Splitting funds increases the number of outputs investigators must monitor, but does not erase the public transaction history or establish that 19 different people control the addresses.
Why Stablecoin Freezes Do Not Work the Same Way for Bitcoin
Stablecoin issuers can restrict transfers through controls built into their token contracts. Bitcoin has no equivalent issuer-operated blacklist. Bitcoin.org explains that there is no central authority to reverse a payment: a confirmed transfer cannot simply be undone by customer support.
That does not make stolen BTC untraceable or immune to seizure. TRM Labs’ analysis says exchanges, swap services and over-the-counter brokers should screen incoming funds linked to the theft. A cooperating custodian can restrict access to funds it controls, even though it cannot rewrite Bitcoin’s ledger.
Investigators can also recover bitcoin if they obtain control of the relevant private keys. In a separate historical example, the US Justice Department seized 63.7 BTC connected to the 2021 Colonial Pipeline ransom after the FBI obtained access to a receiving address’s key. That case does not establish access to the Binance attacker’s keys or guarantee a similar recovery.
Binance Pledges Coverage as the Signing Investigation Continues
TRM attributes the broader theft to North Korea’s TraderTraitor group with high confidence and assesses that Binance’s hot-wallet signing infrastructure was compromised. Its findings describe ordinary signed transfers on Bitcoin and other chains alongside an EIP-7702 delegation used on Ethereum.
Binance’s own preliminary statement points to a possible compromise of a DevOps engineer’s laptop and says there is no evidence of wallet private-key leakage. Unauthorized use of a signing service and extraction of its keys are different possibilities; valid transactions alone do not resolve which access path was used.
The exchange estimates total impact at around $6.3 billion, says about $3 billion in affected assets has been frozen, and promises to cover all losses through SAFU and company funds. Frozen assets have not necessarily been returned, and the coverage pledge is separate from a completed recovery.
Binance’s newer service update, issued at 04:36 UTC on October 30, says deposits are operating normally while withdrawals remain paused. It expects withdrawals to resume within 48 hours as security work continues; that remains a target, not confirmation of reopening.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
