Nineteen addresses, seventeen of which hold exactly 1,000 BTC apiece: that is how Bitquery, the blockchain analytics firm, describes the Bitcoin held by whoever drained Binance on Thursday. The total is awkward for the corporate world, since a thief now holds more Bitcoin than most public companies ever bothered to buy.
As of early Friday, Oct. 30, the attacker-linked wallets held 18,270 BTC, worth roughly $1.4 billion at current prices, according to Cointelegraph's reading of the Bitquery data. The other two wallets carry what remains after the seventeen round-number ones, about 1,270 BTC between them.
A thief's balance sheet
The comparison that drew attention is with Coinbase. In its latest quarterly disclosure, as of Sept. 30, the exchange reported 17,954 BTC held for investment and another 117 BTC for operations, 18,071 BTC in all. The attacker's stack exceeds that by 199 coins.
One caveat on scale. Coinbase's figure excludes the Bitcoin it safeguards for customers, a separate and far larger pool, so the comparison says nothing about who controls more Bitcoin worldwide. It concerns corporate treasury balances, the measure BitcoinTreasuries.net uses to rank public companies, and on that tracker Coinbase sits eighth among listed firms, using its 17,954 BTC investment balance.
The Ether side is less flattering still to the corporate leaderboard. Bitquery traced 508,621 ETH to the attackers on the same Friday snapshot. For comparison, BitcoinTreasuries.net ranks The Ether Machine among the three largest corporate Ether holders, at 495,362 ETH. The attackers are ahead there too.
Most of that Ether was not taken directly. Bitquery says the raiders took 200,630 ETH in the breach itself and built the remainder (call it 308,000 ETH) by swapping stolen stablecoins and other tokens. On one reading, that is a small tell about intent: converting assets that can be frozen into assets that are harder to freeze is a standard move, and it suggests the group planned the cleanup as well as the break-in. The other reading, that the swaps were improvised, remains possible, though it sits poorly beside the speed of everything else.
What happened to Binance
Binance confirmed on Friday that it had lost $6.3 billion. The Bitcoin was taken from hot wallets, and the attackers reached nine blockchains inside a window of less than four hours on Thursday. Nine chains in a single afternoon is not something one improvises.
The exchange says roughly $3 billion of the stolen assets has been frozen, and it has promised to cover all customer losses. Neither claim has been independently audited, and the second is a promise, not a ledger entry. Whether Binance can absorb a loss of this size without strain is a question the company has not addressed in detail.
On the cause, the account has already shifted once. Binance's first explanation was that an engineer in its DevOps team had a laptop that was compromised. Investigators have since found additional breach points, so the laptop was at best one door among several. Nobody outside the company has said how many, or which systems they connected to.
Attribution and the usual suspect
TRM Labs, the blockchain intelligence firm, has pinned the attack on TraderTraitor, a hacking group tied to North Korea. Attribution in this field rests on on-chain behavior, laundering patterns and infrastructure overlap, and it is usually probabilistic. Still, TraderTraitor has a record of going after exchange infrastructure through individual employees, and a DevOps laptop as an entry point fits that pattern.
If the attribution holds, the next phase is predictable and slow. The 1,000 BTC round lots look staged for distribution, denominations that make splitting and mixing straightforward. Freezing is a race between exchanges, stablecoin issuers and the launderers, and the $3 billion already locked suggests the defenders got a head start on part of the haul.
Markets reacted, and not quietly. A separate Cointelegraph headline put liquidations at $1.6 billion in the wake of the hack. That figure belongs to a different piece, and I would treat the cause as plausible rather than proven: leveraged positions unwind for many reasons, and a headline theft is only one of them.
What to watch
Three things are worth checking in the coming days.
First, whether those 17 round-lot Bitcoin addresses move. Staying put suggests the group is waiting for attention to fade. Movement into mixers or cross-chain bridges will test how much of the Bitcoin can be traced to the end.
Second, the Ether. A balance above 500,000 ETH is large enough that dumping it carelessly would move the market, so any sudden conversion would be visible and probably hurried.
Third, Binance's own disclosures. The company has said it found more breach points than it first suspected, and a fuller post-mortem will show whether the failure was one engineer's machine or a structural weakness in how hot wallets were guarded. The answer matters to every exchange running a similar setup, including the one whose treasury the attacker has just overtaken.