The 18,270 Bitcoin in the 19 Addresses the FBI Ties to the Binance Theft Have Not Moved
All 19 were funded between 20:20 and 20:48 UTC on 29 October and have sent nothing since. The FBI says the thieves are converting what they took mainly into ether.
The FBI's alert of 31 October attributes the theft of more than $6 billion in virtual assets from Binance, on or about 29 October, to North Korea, and lists 19 bitcoin addresses that it says are holding or have held assets from the theft.01 At block 975,141, mined at 06:47 UTC on 9 November, the 19 held 18,270.20161965 bitcoin together. The alert's page shows it was last updated on 2 November.
Eighteen of the addresses were funded in block 973,732, mined at 20:20 UTC on 29 October: 17 with exactly 1,000 bitcoin each and one with 832.49990088.02 The nineteenth received 437.69998739 bitcoin in block 973,738, at 20:48 UTC.03 The remaining 0.00173138 bitcoin came in small amounts sent to the addresses later. Each address has received between 9 and 16 transactions, its funding included, and none has sent any.
Method
The 19 bitcoin addresses are copied from the FBI's alert and checked set-equal against the desk's own trace of 1 November. Each address was read on mempool.space's address API at block 975,141: its first funding transaction, block and amount, its balance, and its spent outputs (none). The chart draws first fundings; the 0.00173138 bitcoin sent later is in the subtitle's total.
Binance's initial report on the theft, posted on 3 November, says a Binance hot wallet sent 18,270 bitcoin to an attacker-controlled address.04 It puts the digital assets affected at about $6.34 billion, of which about $2.85 billion had been frozen or intercepted, and says Binance, not its users, will absorb the loss; by 31 October it had replenished 98 percent of the affected token assets. It says its investigation continues and its findings will be reviewed independently.
The FBI calls the activity TraderTraitor and says that it and its partners at the Secret Service and IRS Criminal Investigation have seen the actors converting the stolen assets primarily into ether. The three agencies ask THORChain and RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual asset services to block transactions with, or derived from, the listed addresses: 19 on Bitcoin, 608 on Ethereum and one on Solana. The alert gives no bitcoin total; the figure here is the Gazette's reading of the 19 addresses on the chain, and this piece reads only those addresses. North Korea rejected the attribution, CNBC reported on 3 November, citing the state news agency.07
Binance's reserves snapshot taken at 00:00 UTC on 4 November lists 685,523.923 bitcoin in net customer balances against 685,732.066 bitcoin in reserves, 8,324.172 of it with third-party custodians.05 Those are Binance's figures; the Gazette has not run Binance's reserves verifier, which requires a Binance account login. At 06:03 UTC on 9 November Binance's public settings showed bitcoin withdrawals open on the Bitcoin network and closed on Lightning, with 11 November given as the expected date Lightning withdrawals reopen.06
The Treasury's sanctions actions since the theft list none of the 19 addresses, and the Justice Department has announced no seizure of funds held at them.0809