Binance hacker splits $1.4 billion in Bitcoin across 19 wallets
Security & Exploits ·
An attacker behind a Binance security breach has fragmented roughly $1.4 billion in stolen Bitcoin into 19 separate addresses, a move that complicates efforts by exchanges and authorities to freeze the funds.
The exploiter is currently holding 18,270.2 BTC, valued at approximately $1.44 billion, spread across the 19 wallets, with no liquidation activity detected so far, according to a post on x.com. Splitting a large holding into many smaller wallets is a common tactic used to avoid triggering freeze mechanisms that exchanges and stablecoin issuers can apply to flagged addresses.
The breach has had a visible market impact. BNB fell 7.1% and Bitcoin dropped below $77,000 following the hack, according to reporting from theblock.co. Binance's Co-CEO Yi He has pledged to cover all user losses stemming from the incident.
On-chain monitoring tied to the same cluster of activity shows $5.643 billion in outflows from Binance wallets, occurring alongside $2.316 billion in stablecoin freezes carried out by Tether and Circle. The scale of the freezes suggests issuers are moving to contain funds linked to the exchange's wallets even as the Bitcoin-denominated proceeds remain mobile and unfrozen across the 19 addresses.
Four distinct sources are tracking developments in this cluster, pointing to sustained attention on whether the fragmented BTC holdings will eventually move toward exchanges, mixers, or other venues where they could be further obscured or liquidated. No liquidation has been detected to date, leaving open whether the hacker is waiting out scrutiny or testing which wallets remain unflagged.
What remains unresolved is how authorities and Binance plan to track or restrict the Bitcoin portion of the stolen funds, given that stablecoin freezes do not extend to BTC held in self-custodied wallets. Also unclear is the full scope of user losses Binance intends to cover under Yi He's pledge, and whether the 19-wallet structure will shift as the exploiter seeks further anonymity. Market reaction to the breach, including the BNB and BTC price declines noted by theblock.co, will likely continue to be watched as the situation develops.