Binance Hack Wallets Hold 18,270 BTC, Surpassing Coinbase Treasury

New on-chain analysis is sharpening the picture of who benefited from Binance’s reported $6.3 billion hack—and how much of the stolen crypto remains under attacker control. According to blockchain analytics firm Bitquery, the perpetrators held about 18,270 Bitcoin across 19 addresses as of Friday, valuing the balance at roughly $1.4 billion.

The findings arrive alongside details from Coinbase’s latest public filings and Binance’s ongoing response efforts. Bitquery’s traced Bitcoin holdings also exceed the amount Coinbase discloses holding for investment and operations—though not the portion Coinbase holds on behalf of customers.

Key takeaways

• Bitquery traced 18,270 BTC (about $1.4B) linked to the Binance hacker across 19 addresses as of Friday.
• That total is 199 BTC higher than the combined 18,071 BTC Coinbase reported holding for investment and operations as of Sept. 30 (excluding customer balances).
• Binance said roughly $3B in stolen assets were frozen and pledged to cover all losses.
• TRM Labs has attributed the attack to North Korea-linked TraderTraitor, according to Cointelegraph reporting.

Attacker Bitcoin holdings outsize corporate treasuries

Bitquery’s investigation, shared via its report on the Binance hack, traced 18,270 BTC held by the attackers to 19 addresses. The balance was estimated at about $1.4 billion in value at the time of the snapshot.

Bitquery’s breakdown indicates that 17 of the attacker-linked addresses each held 1,000 BTC, while the remaining coins were distributed across two other wallets. Such concentration patterns are often useful for investigators when identifying clustering behavior and mapping how stolen funds are staged for later movement.

Importantly, the comparison with Coinbase comes from a specific part of the exchange’s public reporting. Coinbase’s disclosure, filed with the U.S. SEC, shows it held 17,954 BTC for investment and 117 BTC for operations as of Sept. 30, totaling 18,071 BTC. That figure does not include the Bitcoin Coinbase holds for customers. Still, Bitquery’s traced attacker total of 18,270 BTC exceeded Coinbase’s disclosed corporate balance by 199 BTC.

BitcoinTreasuries.net, which ranks corporate holdings based on publicly available data, places Coinbase eighth among publicly traded companies by Bitcoin holdings, using the 17,954 BTC investment balance.

Binance reports freezing part of the loot

While Bitquery’s snapshot helps quantify the attacker-held portion, Binance’s own public update emphasizes what it says has already been contained. Binance confirmed that it suffered the $6.3 billion hack and said about $3 billion in stolen assets had been frozen. The exchange also pledged to cover all losses.

According to Binance’s statements as covered by Cointelegraph, investigators later uncovered additional breach points. The exchange had initially suspected a compromise involving a laptop belonging to a DevOps engineer, but Binance said subsequent investigation shifted attention to other areas of the incident.

For market participants, this mix of disclosures matters: the proportion of funds that are frozen versus funds that remain liquid and accessible affects how quickly stolen assets can be moved, swapped, or dispersed across chains.

Ether flows and how the attackers built their stack

Bitquery’s tracing did not stop at Bitcoin. In the same Friday snapshot, Bitquery said it traced 508,621 Ether (ETH) to attacker-linked activity, exceeding the 495,362 ETH attributed to The Ether Machine by BitcoinTreasuries.net (ranked third among corporate Ether holders).

Bitquery also described the attackers’ ETH accumulation path. It reported that the attackers initially stole 200,630 ETH and built the rest by swapping stolen stablecoins and other tokens—a detail that helps explain how attackers can increase exposure in a primary asset even when the initial theft includes multiple token types.

In addition, Bitquery said the stolen Bitcoin originated from Binance hot wallets during the breach, which it characterized as affecting nine blockchains in under four hours on Thursday.

Attribution and what remains uncertain

Attribution remains an important piece of the story, but it is also where uncertainty can persist until investigations fully converge. Cointelegraph reported that TRM Labs has attributed the attack to North Korea’s TraderTraitor hacking group, citing TRM Labs analysis.

Binance, meanwhile, continued to refine its account of how the breach occurred, moving beyond early assumptions about a single compromised device toward a broader set of breach points. The attacker’s large balances—on both Bitcoin and Ether—underscore why these details matter: understanding the method helps investigators anticipate how funds were staged and whether additional wallets or related incidents may emerge.

For investors and traders, the key question now is not only how much crypto was stolen, but how much of the remaining balances can be accessed, exchanged, or disrupted. Bitquery’s snapshot offers a window into attacker-controlled holdings at a particular time, while Binance’s claim that about $3 billion was frozen signals that not all assets followed the same fate.

Readers should watch for follow-up onensics from Bitquery and other blockchain intelligence providers—especially any changes in the distribution of attacker-linked addresses after asset freezing efforts—and for further clarification from Binance on the specific breach pathways that allowed funds to move across multiple chains.