The perpetrators behind the staggering $6.3 billion Binance hack held more Bitcoin on Friday than major cryptocurrency exchange Coinbase maintained for its own corporate investment and operational purposes at the end of September. This unprecedented accumulation highlights the immense scale of the digital assets in the hands of the threat actors following one of the most destructive cybersecurity incidents in the history of the cryptocurrency industry.
According to data compiled and traced by blockchain analytics firm Bitquery, the attackers held 18,270 Bitcoin, valued at approximately $1.4 billion, distributed across 19 distinct addresses as of Friday. To put this massive haul into perspective, Coinbase reported holding 17,954 Bitcoin specifically designated for investment, alongside an additional 117 Bitcoin allocated for operations, as of September 30. This brought Coinbase’s combined corporate treasury holdings to 18,071 Bitcoin. Consequently, the Binance hacker’s single illicit stash exceeded the exchange’s entire corporate holding by 199 Bitcoin. It is worth noting that these figures regarding Coinbase exclusively represent corporate treasury funds and do not encompass the vast amounts of Bitcoin that the exchange securely maintains on behalf of its millions of retail and institutional customers.
When evaluating these figures within the broader corporate landscape, BitcoinTreasuries.net ranks Coinbase eighth among publicly traded companies worldwide by virtue of its 17,954 Bitcoin investment balance. The fact that an unidentified hacking collective has amassed a larger single concentration of the digital asset than a leading global publicly traded exchange underscores the profound challenges facing cybersecurity protocols within the decentralized finance ecosystem.
The massive cryptocurrency theft came to light on Friday when Binance officially confirmed that it had fallen victim to a catastrophic $6.3 billion security breach. In the immediate aftermath of the exploit, exchange leadership moved quickly to reassure users and mitigate further damage, stating that approximately $3 billion worth of the stolen assets had successfully been frozen. Furthermore, Binance executives publicly pledged that the exchange would fully cover all customer losses resulting from the incident, drawing upon its extensive reserves to maintain user trust and market stability.
As the investigation into the origins and execution of the hack intensified, blockchain intelligence firm TRM Labs attributed the sophisticated attack to TraderTraitor, a notorious hacking group widely linked by cybersecurity researchers and international authorities to North Korea. Meanwhile, Binance provided updates regarding the ongoing forensic examination, noting that investigators had uncovered additional breach points across its infrastructure. This development followed earlier preliminary assessments by Blockaid CEO and other researchers who had initially suspected that a compromised laptop belonging to a DevOps engineer might have served as the primary entry point for the malicious actors.
Detailed breakdowns of the on-chain activity provided by Bitquery shed further light on the meticulous organization of the stolen funds. Out of the 19 addresses identified as belonging to the attackers, 17 individual wallets were found to hold exactly 1,000 Bitcoin each, while the remaining balance of the stolen coins was distributed across two other wallets. The initial theft targeted Binance hot wallets during a rapid, coordinated breach that systematically compromised nine different blockchains in a span of under four hours on Thursday.
The scale of the attackers’ liquidity extends far beyond their Bitcoin holdings. Bitquery’s Friday snapshot revealed that the malicious actors also controlled 508,621 Ether. This accumulated pile surpasses the 495,362 Ether that BitcoinTreasuries.net attributes to The Ether Machine, an entity that currently ranks third on the platform’s list of corporate Ether holders.
According to Bitquery, the attackers initially made off with 200,630 Ether during the primary breach on Thursday. They subsequently expanded their holdings of the second-largest cryptocurrency by actively swapping various stolen stablecoins and other diverse digital tokens across decentralized and centralized liquidity pools, consolidating their gains before blockchain security firms and exchange partners could intercept the movement of the capital.
As live updates continue to emerge from blockchain investigators and exchange representatives, the incident remains a stark reminder of the persistent and evolving threats targeting central infrastructure within the global cryptocurrency market. Investigators continue to monitor the dormant and active wallets linked to the TraderTraitor group, while exchanges and compliance teams worldwide coordinate efforts to blacklist addresses associated with the historic $6.3 billion exploit.
Comments (0)