Binance Hacker Bitcoin Windfall Exceeds Coinbase Treasury Holdings

Blockchain analytics firm Bitquery says the individuals behind Binance’s $6.3 billion hack controlled more Bitcoin on Friday than Coinbase reported holding for its own investment and operating reserves at the end of September. The comparison underscores how quickly stolen crypto can be consolidated into large balances—even as exchanges move to freeze some funds.

In a report published on its investigations page, Bitquery traced 18,270 BTC—worth about $1.4 billion—across 19 addresses linked to the attacker. That total exceeds Coinbase’s combined Bitcoin holdings for investment and operations as of Sept. 30, which the U.S. exchange disclosed in an SEC filing.

Key takeaways

• Bitquery traced 18,270 BTC to 19 attacker-linked addresses after the Binance hack, totaling roughly $1.4 billion.
• Coinbase reported 17,954 BTC held for investment plus 117 BTC held for operations as of Sept. 30, for 18,071 BTC combined—about 199 BTC less than the attacker’s total.
• Binance said about $3 billion of stolen assets had been frozen and pledged to cover losses.
• TRM Labs attributed the hack to North Korea-linked TraderTraitor, while Binance said it later found additional breach points.

Attacker Bitcoin balances outstrip Coinbase’s disclosed reserves

Bitquery’s tracking snapshot on Friday showed 18,270 BTC distributed among 19 addresses connected to the attackers. The firm’s write-up frames this as consolidation of stolen funds from Binance’s hot wallet infrastructure.

To contextualize the scale, Coinbase’s most recent disclosed Bitcoin holdings as of Sept. 30 are materially smaller than Bitquery’s attacker-linked total. According to Coinbase’s SEC filing, the company held 17,954 BTC for investment and 117 BTC for operations, a combined 18,071 BTC. Notably, Coinbase’s disclosure does not include Bitcoin held on behalf of customers.

BitcoinTreasuries.net also ranks Coinbase eighth among publicly traded companies by Bitcoin holdings, using Coinbase’s 17,954 BTC investment balance as the basis for its list. The comparison highlights that, at least at the snapshot time, the Binance attackers had effectively amassed a bigger “own-positions” style Bitcoin pile than a major exchange operator disclosed for its corporate books.

Binance confirms a $6.3B hack and says funds were frozen

Binance acknowledged the incident earlier on Friday, confirming it had suffered a $6.3 billion hack. The exchange said investigators were able to freeze roughly $3 billion in stolen assets and that it would cover all losses.

The freezing figure is central to understanding why on-chain totals can look uneven in analytics snapshots: even when part of the stolen crypto is immobilized, the remainder may continue moving and consolidating across attacker-controlled addresses. Bitquery’s Friday tracing illustrates the kind of post-hack reallocation that can occur even amid freezing efforts.

TRM Labs has tied the operation to North Korea’s TraderTraitor hacking group. Binance, meanwhile, said it later uncovered additional breach points after it initially suspected a compromised laptop belonging to a DevOps engineer.

What Bitquery says about the Bitcoin flow and timing

Bitquery reports that 17 of the attacker-linked Bitcoin addresses each held 1,000 BTC, while the remaining holdings were split between two other wallets. The firm also attributes the stolen Bitcoin to Binance hot wallets taken “during a breach” that affected nine blockchains in less than four hours on Thursday.

That timing matters for market participants watching incident response and custody risk. Rapid, multi-chain compromise followed by fast wallet structuring can compress the window in which exchanges are able to detect, isolate, and freeze funds. It also helps explain why analytics firms can see large balances quickly after the initial breach, even when the target company reports that a substantial portion was frozen.

Ether tracking and token-swapping during consolidation

Bitcoin was not the only asset Bitquery linked to the attackers. In the same Friday snapshot, the firm traced 508,621 ETH to attacker-controlled addresses—an amount higher than the 495,362 ETH attributed to The Ether Machine by BitcoinTreasuries.net’s Ethereum holder rankings.

Bitquery adds that attackers initially stole 200,630 ETH and then accumulated additional Ether by swapping stolen stablecoins and other tokens. That detail points to a common pattern in large exchange hacks: rather than keeping all stolen value in one asset, attackers often rotate into additional currencies to move through liquidity and reduce traceability.

On-chain reconstructions such as these help analysts separate confirmed theft from later movements. They also give investors and traders a clearer picture of how quickly stolen balances can be reshaped—either into holdings that remain liquid for potential sale, or into positions that may be held longer.

As Binance continues to investigate the breach and TRM Labs’ attribution is weighed by investigators and the broader market, the next pressure point for readers is likely to be what proportion of the remaining funds stays frozen versus what attackers manage to move later. Bitquery’s address-linked balance snapshots will be one of the key datasets to watch for updates on whether the attacker’s holdings continue to concentrate, diversify, or change hands.