Binance Hack’s 18,270 Bitcoin Remained in 19 FBI-Listed Addresses on Sunday, Nov. 1

A blockchain balance snapshot showed 18,270.20101409 Bitcoin (BTC) across 19 addresses listed in an FBI alert, with no Bitcoin leaving those addresses by 8:47 a.m. EST Sunday, Nov. 1 (13:47 UTC). The balance was valued at about $1.4 billion at that cutoff, leaving the Bitcoin traced from Binance’s Thursday, Oct. 29, breach in the listed addresses.

The snapshot balance was 0.00101409 BTC above the original transfer total of 18,270.2 BTC. Small unsolicited transfers can cause slight differences in address balances and may explain the gap here, though the exact cause of the difference is not established by the balance figure.

Blockchain transaction records show the Bitcoin left a Binance wallet in 11 transactions confirmed at 4:20:06 p.m. EDT Thursday, Oct. 29 (20:20:06 UTC). Seventeen of the 19 destinations received 1,000 BTC each; one received 832.5 BTC and another received 437.7 BTC. Together, those transfers total 18,270.2 BTC. The transaction record traces the Bitcoin to the addresses later included in the FBI alert.

In a Saturday, Oct. 31, notice, the Federal Bureau of Investigation (FBI) attributed Binance’s theft of more than $6 billion in virtual assets to North Korea and named the activity TraderTraitor. The bureau said the listed addresses held or had held stolen assets and were operated by, or closely connected to, TraderTraitor actors.

Binance placed the hot-wallet attack at about 4:05 p.m. EDT Thursday, Oct. 29, and estimated losses of about $6.3 billion across affected token assets. That estimate covers the broader breach, while the $1.4 billion figure is a snapshot valuation of the Bitcoin in the 19 addresses.

The FBI said it had observed TraderTraitor actors converting stolen assets mainly into Ether (ETH). The alert did not say the Bitcoin in these 19 addresses had been converted. It urged exchanges, decentralized finance services and other virtual asset providers to block transactions involving listed addresses or derived from them. The notice did not report a seizure of the Bitcoin.