The 18,270 BTC stolen from Binance is worth approximately $1.4 billion, exceeding the Bitcoin reserves of Tesla and El Salvador while coming within 442 BTC of SpaceX’s reported holdings. Blockchain analytics investigators have attributed the massive breach to a North Korean state-sponsored hacking group.

The attackers removed more Bitcoin from Binance on Thursday than Tesla reportedly owns and more than double El Salvador’s national Bitcoin reserve. The stolen 18,270 BTC compares with Tesla’s disclosed 11,509 BTC and approximately 7,820 BTC held in wallets identified by El Salvador’s National Bitcoin Office as of Friday.

With Bitcoin trading near $78,500, the stolen assets carry an estimated market value of $1.4 billion. The total is also close to SpaceX’s reported Bitcoin position of 18,712 BTC, representing a difference of just 442 coins. Both companies reported their holdings as of Sept. 30 through quarterly disclosures published this month.

El Salvador began accumulating Bitcoin in September 2021. The amount taken in the Binance attack represents roughly 2.3 times the country’s current reserves, with the stolen transfers confirmed in a single blockchain block.

TRM Labs, a blockchain intelligence firm, linked the incident to TraderTraitor with a high degree of confidence. The group is believed to be backed by North Korea and was previously identified by the FBI as responsible for the $1.5 billion Bybit exploit in February 2025. Binance has not yet disclosed who it believes carried out the attack.

Blockchain trail reveals movement of stolen funds

The stolen Bitcoin started moving out of Binance at approximately 4:20 p.m. ET on Thursday. Data from mempool.space shows that an exchange hot wallet, which is connected to the internet and used to handle customer withdrawals, transferred the funds to a newly created address through 11 transactions.

The destination wallet subsequently divided the Bitcoin among 19 separate addresses. Seventeen of these addresses received exactly 1,000 BTC each, while the other two received approximately 833 BTC and 438 BTC. According to available records, none of the receiving wallets had moved its Bitcoin by 2:02 a.m. ET on Friday.

Binance reports billions in frozen assets

By Saturday morning in Asian markets, Binance said it had frozen approximately $3 billion of the estimated $6.3 billion stolen through the exploit.

Stablecoin providers Tether and Circle have contributed significantly to these efforts. Their dollar-pegged tokens feature controls that enable the issuers to block transactions involving specific wallet addresses, preventing restricted assets from being transferred.

Other cryptocurrency exchanges and custodians can also freeze stolen Bitcoin once it reaches their platforms. These measures provide investigators with another opportunity to intercept funds if the hackers attempt to exchange or liquidate their holdings.

Binance’s investigation into the security incident continues to evolve. Its initial assessment suggested that an engineer’s laptop may have been compromised. However, a Friday update revealed that investigators had discovered additional potential points of compromise. The exchange also emphasized that it had found no evidence of wallet private keys being leaked.

To cover the stolen assets, Binance said it had committed more than $6.34 billion in corporate funds. Approximately $5 billion was already held in the affected cryptocurrencies, while the exchange was working to obtain the remaining amount through market purchases and privately negotiated transactions.

Withdrawals continued to remain suspended as Binance conducted further security assessments. The exchange also plans to publish updated proof-of-reserves information on Monday, Nov. 2, providing details of its holdings and the assets supporting customer balances.