BTC news: Bitcoin stolen from Binance tops Tesla’s holdings and is over twice El Salvador’s reserve - CoinDesk

The stolen 18,270 bitcoin compares with Tesla's 11,509 BTC and about 7,820 BTC in El Salvador's national reserve, as published by the country's National Bitcoin Office. At $78,500 per coin, the haul is worth roughly $1.4 billion. The theft also comes within 442 BTC of SpaceX's 18,712 BTC holdings, with both companies disclosing their holdings as of Sept. 30 in recent quarterly filings.

North Korean Connection

Blockchain intelligence firm TRM Labs attributed the attack 'with high confidence' to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI previously blamed that group for the $1.5 billion Bybit theft in February 2025. Binance has not officially identified the attacker.

Attack Details

The bitcoin left Binance at about 4:20 p.m. ET on Thursday. A hot wallet sent the coins to a new address in 11 transactions, according to mempool.space records. The receiving address then split the money among 19 addresses, with seventeen holding exactly 1,000 BTC each, and the other two holding about 833 BTC and 438 BTC.

Exchange Response

As of Saturday morning, Binance reported that approximately $3 billion of the roughly $6.3 billion stolen had been frozen onchain, largely through cooperation with stablecoin issuers like Tether and Circle. The exchange has set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in affected cryptocurrencies.

Binance's initial investigation pointed to a compromised engineer's laptop, though a Friday update revealed additional breach points. The exchange found no evidence that wallet private keys leaked and planned to publish updated proof-of-reserves results on Monday, Nov. 2, while withdrawals remained suspended during security checks.