Attackers stole 18,270 BTC and 508,621 ETH from Binance hot wallets across nine blockchains in under four hours on Thursday, according to blockchain analysis traced by TRM Labs. By Friday, the 18,270 BTC held by the attackers across 19 addresses exceeded Coinbase’s combined corporate Bitcoin holdings by 199 coins.
Coinbase reported 17,954 BTC in investment holdings and 117 BTC in operational holdings as of Sept. 30, totaling 18,071 BTC. The attackers’ haul of 18,270 BTC places them ahead of Coinbase, which ranks eighth among publicly traded companies by Bitcoin holdings according to BitcoinTreasuries.net.
The total value of stolen assets reached $6.3 billion. The 18,270 BTC alone carried an approximate value of $1.4 billion. Binance confirmed the breach on Friday and stated that approximately $3 billion in stolen assets had been frozen. The exchange pledged to cover all losses.
TRM Labs attributed the attack to North Korea’s TraderTraitor hacking group. Binance investigators initially suspected a compromised laptop belonging to a DevOps engineer but uncovered additional breach points during their investigation.
Of the stolen Bitcoin, 17 addresses held 1,000 BTC each, while 2 wallets held the remaining coins. The attackers accumulated additional Ether beyond the initial 200,630 ETH stolen by swapping stablecoins and other tokens, bringing their total ETH holdings to 508,621 as of Friday’s snapshot. The Ether Machine, a corporate Ether holder, maintains 495,362 ETH, making the attackers’ Ether position substantially larger.
Binance did not specify which nine blockchains were affected by the breach or provide identifiers for the 19 addresses holding the stolen assets.
