Bitcoin stolen from Binance tops Tesla’s holdings and more than doubles El Salvador’s reserve

Hackers took 18,270 bitcoin from Binance, about $1.4 billion at $78,500 per coin, in a theft that now exceeds Tesla’s holdings and is roughly 2.3 times El Salvador’s current national reserve. For exchanges, PSPs, and custodians, the useful part is not the headline number; it is the mechanics of freezing, tracing, and trying to stop the cash-out before the coins move beyond reach.

1. The stolen amount was confirmed as 18,270 BTC, compared with Tesla’s 11,509 BTC and about 7,820 BTC in the reserve wallets published by El Salvador’s National Bitcoin Office as of Friday. It also sits within 442 BTC of SpaceX’s 18,712 BTC, based on quarterly filings published this month.
2. TRM Labs attributed the attack “with high confidence” to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI blamed the same group for the $1.5 billion Bybit theft in February 2025. Binance has not identified the attacker.
3. The bitcoin left Binance at about 4:20 p.m. ET on Thursday. According to mempool.space records, a hot wallet, the internet-connected account an exchange uses to pay customer withdrawals, sent the coins to a new address in 11 transactions. That receiving address then split the funds among 19 addresses: 17 holding exactly 1,000 BTC each, plus two addresses with about 833 BTC and 438 BTC.
4. Binance said as of Asian morning hours Saturday that approximately $3 billion of the roughly $6.3 billion stolen across cryptocurrencies had been frozen onchain. A large part of that freeze depended on stablecoin issuers such as Tether and Circle, whose dollar-pegged tokens can be blocked at the address level. Exchanges and custodians can also stop stolen bitcoin if it is deposited with them before conversion or withdrawal.
5. Binance said it had set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in the cryptocurrencies affected by the theft, while withdrawals remained suspended. The exchange’s initial explanation pointed to a compromised engineer’s laptop, but a Friday update said investigators had found additional breach points and had found no evidence that wallet private keys leaked.

For high-risk payment providers, the important detail is that the attacker’s first move was onchain fragmentation, not immediate liquidation. Once funds are split into many addresses, the practical response shifts to screening deposits, freezing at custodians, and tracking movements across wallets before the stolen BTC reaches an exchange that will actually turn it into spendable value.