Binance Hacker Bitcoin Haul Surpasses Coinbase Treasury

TL;DR

• The attackers behind the Binance hack hold 18,270 BTC, worth approximately $1.4 billion, exceeding Coinbase’s corporate Bitcoin holdings.
• Binance confirmed the theft of $6.3 billion in digital assets and said approximately $3 billion has already been frozen. The company pledged to cover all losses.
• The attackers also hold 508,621 ETH. TRM Labs attributed the attack to the North Korean hacking group TraderTraitor. The investigation into the vulnerabilities exploited is still ongoing.

The attackers behind the $6.3 billion Binance hack hold more Bitcoin than Coinbase’s corporate treasury, according to an analysis of addresses linked to the attack conducted by blockchain intelligence firm Bitquery.

Investigators identified 18,270 BTC, worth approximately $1.4 billion, spread across 19 addresses controlled by the attackers.

Coinbase reported holding 17,954 BTC for investment and another 117 BTC for operations at the end of September, totaling 18,071 BTC. The hackers’ holdings exceed that amount by 199 BTC. This comparison excludes the funds Coinbase holds in custody for its customers.

Binance Hacker Distributed 18,270 BTC Across 19 Addresses

According to Bitquery, 17 of the identified addresses hold exactly 1,000 BTC each, while the remaining 1,270 BTC are distributed across two other wallets.

The funds came from Binance’s hot wallets, which were compromised during an attack that affected nine blockchains in less than four hours.

Binance confirmed the theft and reported that approximately $3 billion in stolen assets had already been frozen. The exchange also pledged to cover the losses caused by the incident.

Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, a hacking group linked to North Korea.

Investigators initially considered the possibility that the attackers had compromised a DevOps engineer’s laptop. Binance subsequently reported that its investigators had identified additional entry points used during the breach.

The Attackers Also Hold More Than 500,000 ETH

Bitquery’s analysis also identified 508,621 ETH controlled by the attackers, exceeding the 495,362 ETH attributed to The Ether Machine by BitcoinTreasuries.net.

The Ether Machine ranks third among companies with the largest corporate Ethereum holdings.

The attackers initially stole 200,630 ETH directly from Binance. They subsequently increased their holdings by swapping stablecoins and other tokens stolen during the incident.

As a result, the ETH balance identified by Bitquery includes both the funds originally stolen in ETH and the assets obtained through subsequent conversions.

Binance’s investigation remains ongoing after the exchange identified multiple compromised entry points during the attack. The company has committed to compensating affected users for their losses.