The short version
- TRM Labs corroborates about 18,270 BTC leaving Binance on October 29.
- CoinDesk reports 19 destination addresses with no outgoing transfers by 04:23 UTC Friday.
- Bitcoin has no issuer blacklist, but exchanges can restrict identified funds.
- The attack’s cause and attribution remain assessments that require careful sourcing.
The Bitcoin outflow has independent support
Blockchain investigation company TRM Labs reports that about 18,270 BTC left a Binance hot wallet at 20:20 UTC on Thursday, October 29, 2026. A hot wallet keeps its signing system connected to the internet so an exchange can process transfers. TRM’s investigation independently supports the Bitcoin outflow, although it does not independently confirm every detail of CoinDesk’s later address count.
TRM valued that Bitcoin at about $1.47 billion when it was taken. CoinDesk’s roughly $1.4 billion figure reflects early-Friday prices. Those amounts describe the same Bitcoin component at different valuations, rather than two separate thefts. Readers checking the Bitcoin price should keep the time of each valuation in mind: a changing dollar quote changes the value assigned to a fixed BTC amount.
The Bitcoin component also sits inside a broader incident. AP reports that Binance estimated an impact of about $6.3 billion, while TRM estimated $6.36 billion across several blockchains. These totals cover more assets than the BTC discussed here. They should not be added to the Bitcoin valuation, because doing so would count the Bitcoin portion twice and overstate the reported loss.
Check Bitcoin’s current reference price
CoinDesk traced the funds to 19 addresses
CoinDesk reports that the Bitcoin reached 19 addresses after the initial outflow. Its breakdown lists 17 addresses receiving 1,000 BTC apiece, one with 832.5 BTC and another with 437.7 BTC. Those reported, rounded amounts add up to 18,270.2 BTC. The detailed distribution remains attributable to CoinDesk; the fact-check review did not independently reproduce the complete set of transfers behind it.
An address is a destination recorded on the Bitcoin network. A wallet is software or a device that manages the keys needed to authorize spending, and one wallet can manage many addresses. Calling these 19 separate wallets would therefore claim more than the public records establish. Our guide to Bitcoin wallets explains how keys, addresses and wallet software work together.
CoinDesk says these addresses had made no outgoing transfers as of 04:23 UTC on October 30. That is a dated observation, not a statement about their current activity. CoinDesk also reports incoming dust deposits, meaning very small amounts of Bitcoin. Those deposits matter when describing balances: an address that received 1,000 stolen BTC may later hold slightly more than that amount.
| Address group | Address count | BTC per address |
|---|---|---|
| Main group | 17 | 1,000 |
| Additional address | 1 | 832.5 |
| Additional address | 1 | 437.7 |
Learn how Bitcoin’s market price is formed
Bitcoin has no issuer freeze button
Native Bitcoin has no company issuer that can place an address on a blacklist and stop its coins from moving. That differs from centrally issued stablecoins, whose operators may have controls that block transfers. The distinction helps explain the recovery challenge here. It does not support a broader claim that stolen Bitcoin is beyond tracing, seizure or recovery under all circumstances.
An exchange or another intermediary can block deposits or withdrawals involving funds it identifies as stolen. Such a restriction applies within that service. It does not rewrite the Bitcoin network’s rules or automatically stop a transfer between addresses outside the service. This difference between network rules and company controls is central to understanding what a freeze can mean in this case.
Bitcoin’s public transaction record gives investigators a way to follow movements between addresses. It does not automatically identify the people controlling them, and following funds does not itself return them to an owner. For readers learning how Bitcoin works, this case illustrates two separate features: transfers leave a visible record, while spending depends on authorization through cryptographic keys rather than an issuer’s approval.
Compare the wider Bitcoin and crypto market
The cause and attacker attribution remain provisional
TRM Labs attributes the attack to North Korea’s TraderTraitor group with high confidence. That is TRM’s assessment, not an established government finding presented in the reviewed material. Naming the source matters because readers need to distinguish an investigation company’s judgment from a court ruling or an agency announcement. The available memo does not establish that those other institutions reached the same finding.
AP reports that Binance’s preliminary explanation involved a compromised DevOps laptop and unauthorized withdrawal requests. DevOps staff help build and operate a company’s software systems. A compromised work computer can give an attacker access to parts of those systems, but the preliminary account does not settle every step of this attack. It should be read as the company’s early explanation.
AP also reports that Binance said it had found no evidence of a private-key leak. That wording describes what the company said its investigation had found at that stage. It is not a completed forensic finding that rules out every possible failure. The fact-check review did not independently inspect a direct Binance statement, court filing or regulator finding that resolves the remaining questions.
Convert a Bitcoin amount using a reference rate
The trail across 19 addresses is a dated snapshot
The clearest supported account has two layers. TRM independently corroborates the approximate BTC outflow and its timing. CoinDesk supplies the more detailed account of 19 destination addresses and their lack of outgoing transfers by its Friday cutoff. Keeping those layers separate makes the report useful without presenting one publication’s complete trace as something this review independently verified from blockchain records.
AP reports that Bitcoin fell 3.2% to below $79,000 on Thursday evening. That price move supplies market context, but it does not establish the theft as the sole cause. Other trading forces can operate at the same time. Readers following Bitcoin markets should distinguish a reported price change from a proven explanation for why buyers and sellers changed their bids.
The next evidence to assess is concrete: any later outgoing transfers, a fuller account of the withdrawal failure, and documented recovery actions. Predictions about laundering remain forecasts until transactions or other evidence support them. For now, the 19-address account describes where CoinDesk traced the Bitcoin at a specific time. It neither establishes permanent inactivity nor decides whether any funds can ultimately be recovered.