Binance Bitcoin Theft Surpasses Major Corporate Holdings
The 18,270 BTC taken from Binance in transfers confirmed Thursday is larger than Tesla’s disclosed Bitcoin position and more than twice the amount held in El Salvador National Bitcoin Office reserve wallets. CoinDesk reported that the Bitcoin haul was worth about $1.4 billion at $78,500 per coin.
The comparison puts one portion of the Binance breach alongside some of the most closely watched institutional Bitcoin holdings, while leaving substantial questions about attribution, the broader incident and whether the stolen assets can be recovered.
What happened
CoinDesk reported that hackers stole 18,270 BTC from Binance in 11 transactions confirmed Thursday. The publication said Binance estimated the total impact of the incident at roughly $6.3 billion across cryptocurrencies.
The Bitcoin component alone is notable because of its size relative to publicly disclosed corporate and government holdings. Tesla held 11,509 BTC, while El Salvador National Bitcoin Office reserve wallets held about 7,820 BTC as of Friday, according to CoinDesk. Captainaltcoin also reported those same approximate holdings figures for Tesla and El Salvador.
The stolen Bitcoin is also close to SpaceX’s 18,712 BTC. CoinDesk said the difference between the 18,270 BTC haul and SpaceX’s reported holdings was 442 BTC. Tesla and SpaceX disclosed their holdings as of Sept. 30 in quarterly filings, CoinDesk reported.
The wider breach was described as affecting nine blockchains in under four hours on Thursday. Binance said about $3 billion had been frozen, CoinDesk reported, and said it had set aside more than $6.34 billion to cover losses. Withdrawals remained suspended, according to the outlet.
CoinDesk reported that blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit. TRM Labs linked the group to the February 2025 theft of $1.5 billion from Bybit, an incident for which the FBI also blamed TraderTraitor.
That attribution is not the same as a public identification by Binance. Binance has not identified the attacker, and the cause of the breach remains under development, with possibilities ranging from a compromised engineer’s laptop to additional points of entry. There is no evidence that wallet private keys leaked.
Why it matters
The 18,270 BTC figure gives a clear measure of the scale of one part of the breach. It exceeds Tesla’s 11,509 BTC and is about 2.3 times the Bitcoin held in El Salvador’s reserve wallets. CoinDesk’s comparison with SpaceX further shows that the stolen amount approached the reported Bitcoin holdings of a major corporate holder.
These comparisons do not establish ownership in the conventional sense. The Bitcoin was reported as stolen, and the key issue is whether the assets can be tracked, blocked at points of conversion or eventually recovered. Unlike stablecoins, the stolen BTC has no issuer freeze control. That leaves exchange blocks on cash-out as the available recourse described for the assets.
Binance’s statement that about $3 billion had been frozen shows that intervention can limit movement or conversion for some assets affected by a breach. But CoinDesk reported that Binance’s estimated total impact was roughly $6.3 billion across cryptocurrencies, meaning the frozen amount and the total estimated impact are separate figures.
The incident also illustrates why disclosed Bitcoin treasury figures can become a useful benchmark during a major cyberattack. Tesla, SpaceX and El Salvador have materially different roles in Bitcoin markets, but their reported balances provide recognizable comparisons for an unusually large stolen balance.
Background and context
Binance estimated that the breach affected nine blockchains and unfolded in under four hours on Thursday. The estimated $6.3 billion impact covers cryptocurrencies beyond the 18,270 BTC highlighted in the holdings comparisons.
Bitcoin differs from assets that have a centralized issuer capable of directly freezing tokens. In this case, exchange restrictions and freezes can constrain attempts to cash out or move assets through services that participate in blocking efforts, but they do not amount to an issuer-level freeze mechanism for Bitcoin itself.
CoinDesk reported that the Bitcoin was worth about $1.4 billion at $78,500 per coin. That valuation is a snapshot tied to the stated per-coin figure, while the 18,270 BTC count is the underlying measure used for comparisons with Tesla, SpaceX and El Salvador.
TRM Labs’ high-confidence attribution is an intelligence assessment, not a confirmed public attribution from Binance. The distinction matters as investigators continue to assess how the breach occurred and what access route was used. The available account does not establish that Binance wallet private keys were leaked.
What to watch
Key questions include whether Binance provides further detail on the entry point used in the breach, whether it identifies an attacker publicly, and whether the explanation narrows the possible role of a compromised engineer’s laptop or additional access points.
It will also be important to follow whether more assets are frozen, whether withdrawals resume, and whether Binance updates its roughly $6.3 billion impact estimate. Any movement of the 18,270 BTC or disclosures about efforts to prevent conversion of the assets would clarify the practical limits of exchange-based blocks.
Finally, the status of TRM Labs’ attribution warrants attention. CoinDesk reported the assessment as high confidence, but Binance has not publicly identified the attacker. Those remain distinct positions.
