Who Took Binance’s Bitcoin, and Why Can’t Anyone Freeze It?

18,270 bitcoin. That's how much was taken from Binance on Thursday, CoinDesk reported. It's more than Tesla's 11,509 BTC, and more than twice the roughly 7,820 BTC in El Salvador's published reserve wallets.

CoinDesk put the haul at about $1.4 billion. That's only the bitcoin part. Binance put the total stolen across all coins at about $6.3 billion, CoinDesk said.

Who did it

Blockchain firm TRM Labs attributed the attack "with high confidence" to TraderTraitor, a North Korean state-backed hacking unit, CoinDesk reported. The FBI blamed the same group for the $1.5 billion Bybit theft in February 2025. Chainalysis has reached the same conclusion, according to Investing.com.

Binance itself has not named the attacker, CoinDesk said.

Why the bitcoin is the hard part

About $3 billion of the stolen assets has been frozen, Binance said, per CoinDesk. Much of that comes from stablecoin issuers like Tether and Circle, which can block transfers from particular addresses.

Bitcoin has no issuer. Nobody can switch it off. CoinDesk said the stolen BTC was split into 19 wallets, and none had moved as of early Friday.

The attackers seem to know this. Investing.com reported they converted $325 million of stablecoins into $285 million of Ether, apparently to get the money out of reach of freezes. Note the gap: they gave up about $40 million to move fast. That's my maths.

What Binance says happens next

Binance said it has set aside more than $6.34 billion of company funds to cover losses, CoinDesk reported. Withdrawals are still suspended during security checks.

On Saturday, Binance said it has now covered about 90% of the stolen assets, CNBC reported. It says all bitcoin, Ether and its other top-10 coins are 100% backed. That's backing from its own funds, not 90% recovered from the hackers. It's still buying the rest on the market.

Binance says withdrawals are on track to reopen on Sunday, 1 November, subject to final security checks, CNBC reported. It plans to publish updated proof-of-reserves on Monday, 2 November, according to CoinDesk and Investing.com. Proof of reserves is a snapshot of what the exchange holds against customer balances.

My read

My read, and it's only a view: the frozen $3 billion shows the crypto world's safety net now leans on centralised companies. That's an odd outcome for a system built to avoid them. The bitcoin that can't be frozen is the test case.

Monday's proof of reserves matters more than any price. If the numbers hold up, the exchange story calms down. If they don't, it gets louder.

Prices, for context

Bitcoin was $77,559 and Ether $2,253 on Coinbase at 6:06pm UK (GMT) on Saturday. Both live, not closes.

Sources. CoinDesk, "Bitcoin stolen from Binance tops Tesla's holdings and is over twice El Salvador's reserve," 31 October 2026. Investing.com, "Bitcoin holds above $77,000 as FBI joins hunt for $6.3 billion Binance hackers," 31 October 2026. CNBC, "Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday," 31 October 2026. Coinbase spot, 6:06pm UK (GMT), 31 October 2026.

Follow Market Live Updates on Medium at https://medium.com/@marketliveupdates and on Instagram at https://www.instagram.com/marketliveupdates/.

Not investment advice.