Bitcoin stolen from Binance tops Tesla’s holdings and is over twice El Salvador’s reserve

On October 29, Binance suffered a major security breach that resulted in the theft of roughly 18,270 Bitcoin, valued at about $1.4 billion. The stolen amount surpasses Tesla’s reported holding of 11,509 BTC and is more than double the Bitcoin reserve held by the government of El Salvador, which stands at roughly 7,474 BTC. Investigators are racing to trace the assets as the exchange reports that about $3 billion of the stolen funds have been frozen, while the total loss is estimated at $6.3 billion across multiple crypto assets.

Background

Binance, the world’s largest cryptocurrency exchange, uses hot wallets to process user withdrawals. On October 29, attackers gained control of these wallets and moved assets in a rapid series of transactions that lasted about 20 minutes. The breach has been linked, with high confidence, to a North Korea‑affiliated group known as TraderTraitor, which previously targeted the Bybit platform. In the aftermath, stablecoin issuers such as Tether and Circle froze the stolen USDT and USDC, but Bitcoin and Ether cannot be frozen by any central authority. Binance has set aside more than $6.34 billion in company funds to cover losses, including $5 billion in matching tokens, and plans to resume withdrawals on November 1 after security checks. The incident has drawn attention to the vulnerability of hot‑wallet infrastructures and the challenges of recovering decentralized assets once they leave an exchange’s control.

What happened

According to analyticsinsight.net, the attackers moved roughly $6.36 billion across multiple blockchains, with the bulk of the theft occurring within about 20 minutes after they accessed Binance’s hot wallets. The exchange reported that around $3 billion of the stolen assets have been frozen, though it has not confirmed how much has been returned to its control. The attackers transferred 18,270 BTC, valued at about $1.4 billion, which analyticsinsight.net notes exceeds Tesla’s reported holding of 11,509 BTC and is more than twice El Salvador’s reserve of roughly 7,820 BTC, while coming within 442 BTC of SpaceX’s reported 18,712 BTC. Blockchain analysts observed that the Bitcoin was initially moved through 11 transactions before being split across 19 addresses, with seventeen wallets receiving exactly 1,000 BTC each and the remaining two holding smaller amounts. Stablecoin issuers responded quickly: Tether froze the affected USDT and Circle restricted USDC, but the conversion of hundreds of millions of stablecoins into Ether before the blocks could be applied made recovery harder. Chainalysis reported that thousands of transactions were used to shuffle other stolen assets, with some funds repeatedly returning to previously used wallets, creating a “cat and mouse” investigation described by TRM Labs’ Ari Redbord to CNBC. Binance has not publicly confirmed the attackers’ identities, but TRM Labs attributes the breach to the North Korea‑linked group with high confidence.

Market impact

The theft of 18,270 BTC, worth about $1.4 billion, represents a significant outflow from Binance’s hot‑wallet balances, prompting the exchange to freeze roughly $3 billion of the stolen assets. Stablecoin markets felt pressure as Tether and Circle blocked the compromised USDT and USDC addresses, temporarily limiting liquidity for those tokens. The conversion of large stablecoin sums into Ether added upward pressure on ETH prices during the brief window before issuers could intervene. Bitcoin’s price remained relatively stable in the immediate aftermath, but the sheer scale of the loss—exceeding the holdings of high‑profile corporate and sovereign wallets—has heightened risk perception among institutional investors, potentially influencing future demand for custodial solutions and insurance products. The incident also underscores the systemic risk posed by large exchanges holding substantial hot‑wallet reserves, a factor that may affect market confidence and the pricing of related security services.

Why it matters

The breach highlights the vulnerability of centralized exchanges that rely on hot wallets for rapid withdrawals, exposing billions of dollars in crypto to rapid exfiltration. The fact that the stolen Bitcoin alone surpasses Tesla’s and El Salvador’s holdings underscores the magnitude of the loss and the potential for market destabilisation if such assets are liquidated quickly. The involvement of a North Korea‑linked group, as suggested by TRM Labs, raises geopolitical concerns and may trigger tighter regulatory scrutiny of crypto exchanges and cross‑border crypto flows. Moreover, the freezing of stablecoins by issuers demonstrates the limited tools available to mitigate theft in decentralized assets, emphasizing the need for improved on‑chain monitoring and perhaps new industry standards for asset protection. Finally, Binance’s decision to set aside over $6 billion in reserves signals the financial strain such attacks can impose on major platforms, potentially influencing how investors assess exchange risk and the demand for insurance solutions in the crypto ecosystem.