By cryptoadmin Hackers linked to North Korea took more bitcoin from Binance on Thursday than Tesla holds, and more than twice the amount in El Salvador’s national reserve.
The 18,270 $BTC stolen compares with Tesla’s 11,509 $BTC and about 7,820 $BTC in the reserve wallets published by El Salvador’s National Bitcoin Office as of Friday. At $78,500 per coin, the haul is worth roughly $1.4 billion.
It also comes within 442 $BTC of SpaceX’s 18,712 $BTC. Both companies disclosed their holdings as of Sept. 30 in quarterly filings published this month.
El Salvador began buying bitcoin in September 2021. The Binance attacker took roughly 2.3 times its current reserve in transfers confirmed in a single block.
Blockchain intelligence firm TRM Labs attributed the attack “with high confidence” to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI blamed that group for the $1.5 billion Bybit theft in February 2025. Binance has not identified the attacker.
The bitcoin left Binance at about 4:20 p.m. ET on Thursday. A hot wallet, the internet-connected account an exchange uses to pay customer withdrawals, sent the coins to a new address in 11 transactions, according to mempool.space records.
The receiving address then split the money among 19 addresses. Seventeen held exactly 1,000 $BTC each, with the other two holding about 833 $BTC and 438 $BTC. None had spent its holdings as of 2:02 a.m. ET on Friday.
Beyond the freeze orders
As of Asian morning hours Saturday, Binance says approximately $3 billion of the roughly $6.3 billion stolen has been frozen onchain.
Much of that protection comes from stablecoin issuers such as Tether and Circle. Their dollar-pegged tokens have controls that let the companies block transfers from particular addresses.
Exchanges and custodians can still block stolen bitcoin deposited with them, giving investigators a chance to intercept funds when attackers try to trade or cash out.
Binance’s explanation of the breach is still developing. Its initial investigation pointed to a compromised engineer’s laptop, but a Friday update said investigators had uncovered additional breach points. The exchange said it had found no evidence that wallet private keys leaked.
Binance said it had set aside more than $6.34 billion in company funds, including $5 billion already held in the cryptocurrencies affected by the theft. It was buying the remaining assets through markets and privately negotiated trades.
Withdrawals remained suspended during security checks. Binance said it planned to publish updated proof-of-reserves results on Monday, Nov. 2, showing its holdings and the backing for customer balances.