An attacker stole more than 18,270 bitcoin from Binance on Thursday and split the coins into 19 wallets within minutes. The bitcoin was worth about USD 1.4 billion at early Friday prices. Blockchain records showed 17 wallets held 1,000 BTC each, while two held smaller amounts.
None of the wallets had sent bitcoin as of 04:23 UTC on Friday. Binance estimates the wider breach at USD 6.3 billion and says it will cover customer losses.
At 20:20 UTC, Binance's hot wallet sent more than 18,270 BTC to one address through 11 transactions. All appeared in Bitcoin block 973,732. A hot wallet connects to the internet and handles exchange withdrawals. The receiving address held the coins briefly before the attacker distributed them further.
The attacker began dividing the funds in that block. CoinDesk traced the transfers through mempool space and found transactions sending 1,000 BTC at a time to new addresses. Each passed the remaining balance to another address.
The process, known as a peel chain, continued as the attacker regrouped leftover amounts and divided them again. A later transfer collected smaller balances into a wallet holding 832.5 BTC.
Then, 28 minutes after the first transfers, another 437.7 BTC reached the nineteenth address in block 973,738. The final distribution left 17 addresses with exactly 1,000 BTC each, plus two smaller wallets.
No outgoing transfers appeared from those wallets by Friday's checkpoint. Instead, strangers sent small deposits worth one or two dollars to some addresses. Those deposits did not move the stolen holdings.
The 11 transfers resembled ordinary Binance withdrawals, according to blockchain records. Each carried a valid signature from a Binance-controlled bitcoin address, matching the format of authorized wallet transactions. Valid signatures alone did not establish that Binance had authorized the withdrawals.
One transfer gathered 18 bitcoin inputs from an address that Whale Alert identified as Binance's. The transaction sent bitcoin to the attacker and returned the remaining change to Binance.
Binance said its initial investigation pointed to a compromised DevOps engineer's laptop. According to the exchange, the intruder reached a service container and used it to submit unauthorized withdrawals.
The exchange found no evidence that a wallet private key leaked. Binance placed the overall damage at USD 6.3 billion, pledged to cover customer losses and kept deposits and withdrawals suspended.
The bitcoin portion alone exceeded the 7,000 BTC stolen in Binance's 2019 hack. Bitcoin traded below USD 5,000 during that incident, compared with roughly USD 78,475 at the time of the latest report.
Read More: Binance Faces USD 5.57 Billion Wallet Outflow: USD 1.8 Billion Stablecoins Frozen
Other stolen assets faced faster restrictions. Tether, Circle, Ripple and other issuers can block addresses through their token contracts. These controls allowed issuers to blacklist attacker-linked addresses within hours.
Bitcoin has no issuer with authority to freeze addresses. Exchanges, over-the-counter desks and swap services must identify and block the funds.
TRM Labs attributed the breach to TraderTraitor, a North Korean hacking unit, with high confidence. After the USD 1.5 billion Bybit theft in February 2025, the same unit spent about 10 days converting stolen ether into bitcoin.
The Binance bitcoin remained in its 19 destination wallets at the Friday checkpoint. That differed from other stolen tokens whose issuers could block transfers.
Sean Foley, a crypto markets expert at Macquarie University, told Al Jazeera that an attack on a major exchange could weaken retail confidence and crypto prices. He said exchange-held assets depend on the operator's security.
TRM's 2026 Crypto Crime Report counted USD 2.87 billion in stolen crypto across nearly 150 incidents during 2025. Binance's USD 6.3 billion estimate surpasses that reported annual figure.
The attacker moved more than 18,270 BTC from Binance into 19 wallets and left the coins untouched through early Friday. Binance traced the breach to unauthorized withdrawals and pledged to cover losses. TRM Labs attributed the attack to TraderTraitor, while Bitcoin lacks a mechanism for issuers to freeze addresses.