18,270.2 Bitcoin Worth $1.4 Billion Moved to 19 Addresses Amid Binance Investigation
Key Facts
TokenPost estimated that the Bitcoin balance linked to the suspected hack transfers was about 18,270.2 BTC, worth approximately $1.4 billion, spread across 19 addresses on October 29. Seventeen addresses held 1,000 BTC each, according to its report on the on-chain movements. The report detected no Bitcoin sales or deposits to an exchange. But Binance has not confirmed that the funds belong to it, nor explicitly confirmed that they were stolen from it. The transfers are part of a wider investigation into a security incident whose total estimated impact the exchange said was about $6.3 billion.
This wording preserves the distinction between tracking the movement of coins and establishing who owns or controls them; the recorded number of addresses does not prove they are independent wallets or belong to one person. Nor does the movement alone establish that the sender intends to sell the assets or transfer them to an exchange. TokenPost said its tracking showed no sales or exchange deposits at the time of observation, while its report did not specify why the balance was distributed among the addresses. The link between this amount and the hack therefore remained suspected, not confirmed by Binance. The tracking did not establish that an imminent liquidation would occur.
Binance said its preliminary investigation suggested the incident may have begun with the compromise of a DevOps engineer’s laptop, which enabled access to a service container and the submission of unauthorized withdrawal transactions. It added that it had found no evidence of private wallet keys being leaked. This account describes a possible route into the service, while the exchange has not yet published the findings of a final technical investigation. Binance temporarily suspended deposits and withdrawals and revoked the affected address’s authorization. It said it had enlisted law enforcement and blockchain intelligence partners to trace the assets and work on recovering them.
In an update on October 30, Binance said about $3 billion in assets had been frozen on-chain in cooperation with partners, out of a total estimated incident impact of about $6.3 billion. A Reuters report the same day said the exchange had stated it froze $2.54 billion in crypto assets during the investigation, with the figure potentially rising. Tether said it had frozen nearly $1.57 billion in assets linked to the incident, while Circle announced a freeze of more than $800 million. The figures reflect estimates and statements published in different updates and reports, and do not mean the full stated impact is recoverable. Binance said it would cover losses from its SAFU fund and company funds, adding that user funds were safe.
Cryptocurrencies fell as news of the incident circulated. The Associated Press reported that Bitcoin fell 3.2% to below $79,000 on the evening of Thursday, October 29. In a later report, Reuters said the currency hit a six-week low and was down 3% at $76,469.82, while Ether fell more than 3% to $2,185.83. Coinbase shares also fell 4.8% and Strategy shares about 6% in extended U.S. trading. These moves place the market response in a period coinciding with news of the incident, but they do not establish that the Bitcoin transfers alone caused the declines.
Historical comparisons suggest the reported scale of the impact puts the incident among the largest crypto asset thefts; Reuters said the largest previously confirmed theft from an exchange was the $1.5 billion Bybit hack in February 2025. CoinDesk said Binance’s SAFU emergency fund holds about $1 billion in Bitcoin and could be used to cover losses. The exchange confirmed it would publish an updated proof of reserves after remediation is complete. It also promised to publish a detailed technical report after the investigation concludes and the facts are verified. The next reserves snapshot is scheduled for November 1, a near-term date for tracking whether Binance has replenished the missing assets.