On October 29, a breach at Binance resulted in the theft of roughly 18,270.2 BTC, valued at about $1.4 billion at the time. The Federal Bureau of Investigation later identified the Democratic People’s Republic of Korea as the main perpetrator.
Details of the theft
The stolen Bitcoin was transferred through 11 transactions before being distributed into 19 separate wallets. All transfers were confirmed at Bitcoin block height 973732. The original hot wallet, identified as bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h, now holds about 5.495 BTC, roughly $426,000.
Attribution and investigation
Blockchain intelligence firms, including Chainalysis, Elliptic and TRM Labs, linked the hack to Tradertraitor, a subgroup associated with the Lazarus Group, a state‑sponsored hacking unit of North Korea. The FBI’s assessment on October 31 reinforced this attribution.
Current status of the stolen funds
To date, the Bitcoin remains untouched across the 19 wallets. Seventeen of the wallets each contain exactly 1,000 BTC, while the remaining two hold 832.5 BTC and 437.7 BTC respectively. The dormancy does not guarantee permanent inactivity, and investigators continue to monitor the addresses for any future movement.
Implications for recovery
Bitcoin’s decentralized design means there is no central authority capable of freezing or reversing the transactions. Recovery efforts therefore focus on tracing the funds to potential exchange or broker endpoints where they might be seized, or on obtaining control of the private keys associated with the wallets.
