The attacker responsible for the Binance hack has distributed 18,270 stolen bitcoin across 19 separate wallets, completing the transfers within minutes. Blockchain records show that the funds have remained untouched since Thursday night, with no outgoing transactions from any of the addresses.

CoinDesk’s blockchain analysis found that 17 wallets contain precisely 1,000 BTC each. The other two hold 832.5 BTC and 437.7 BTC, respectively.

The initial transfer took place at 20:20 UTC on Thursday, when Binance’s hot wallet sent more than 18,270 BTC to a single address through 11 transactions. All 11 transfers were recorded in block 973,732.

Hot wallets are internet-connected wallets that cryptocurrency exchanges use to facilitate customer withdrawals. At early Friday prices, the stolen bitcoin was worth approximately $1.4 billion. This is over 2.5 times the 7,000 BTC taken during Binance’s 2019 hack, when Bitcoin traded below $5,000.

The attacker began breaking up the funds immediately after receiving them. The redistribution transactions were also confirmed in block 973,732, shortly after the original transfers.

CoinDesk tracked the transaction history using data from mempool.space and found that the attacker relied on a technique known as a peel chain. This method involves sending a fixed amount of cryptocurrency to a newly generated wallet while transferring the remaining balance to another address.

The process was repeated to move 1,000 BTC at a time into separate wallets. Some smaller balances were subsequently combined and split again. A final consolidation collected the remaining amounts into an address holding 832.5 BTC.

Approximately 28 minutes later, another transaction placed 437.7 BTC into the 19th wallet in block 973,738.

The resulting distribution left 17 addresses with 1,000 BTC each, one with 832.5 BTC and another with 437.7 BTC. By 04:23 UTC Friday, none of the wallets had sent any bitcoin elsewhere.

The only transactions recorded after the distribution were small unsolicited deposits. Unknown users have been sending amounts worth roughly $1 or $2 to the addresses since late Thursday.

Stolen Bitcoin Remains Difficult to Freeze

The bitcoin transfers highlight the difference between BTC and stablecoins when it comes to restricting stolen assets.

Stablecoin companies such as Tether, Circle and Ripple have administrative control over their token contracts. They can blacklist wallet addresses and prevent transactions involving those addresses, allowing them to restrict stolen stablecoins.

Bitcoin has no central issuer with the ability to freeze funds held in individual wallets. The stolen BTC can therefore be stopped primarily if it reaches a centralized exchange, an over-the-counter trading desk or a cryptocurrency swap service that agrees to block it.

Blockchain analytics firm TRM Labs linked the attack to TraderTraitor, North Korea’s elite hacking group, with what it described as high confidence.

The group was also connected to the $1.5 billion Bybit exploit in February 2025. After that incident, the hackers reportedly spent around 10 days converting the stolen ether into bitcoin.

Binance Identifies Compromised Engineer Laptop in Initial Investigation

The 11 original transfers were structured similarly to ordinary withdrawals processed through Binance.

One of the transactions included 18 bitcoin inputs from an address that blockchain tracker Whale Alert identifies as belonging to Binance. The funds were transferred to the attacker, while the remaining change was sent back to an exchange-controlled address.

All 11 transactions carried valid signatures from bitcoin addresses controlled by Binance.

In a post on X on Monday, Binance said its preliminary investigation suggested that an attacker gained access through a compromised laptop belonging to a DevOps engineer. The device was allegedly used to access a service container and submit unauthorized withdrawal requests.

The exchange emphasized that investigators had found no evidence of leaked private keys associated with its wallets.

Binance estimates the total damage at approximately $6.3 billion and has pledged to cover all losses. Deposits and withdrawals remain suspended while the exchange continues addressing the incident.