Binance Hacker Sends $4 Million to Binance Deposit Addresses as Stolen BTC Stays Largely Unmoved
Part of the roughly $6.3 billion drained from Binance hot wallets on October 29 has reportedly been routed back to the exchange, with $4 million sent to three Binance deposit addresses. Separately, 19 wallets holding 18,270 stolen BTC have received only sub-dollar messages since Thursday.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The $4 Million Return Flow
Crypto Briefing reported that $4 million from the October 29 Binance hot wallet drain was deposited into three Binance deposit addresses, likely after passing through third-party exchanges. Public fund-flow reports had not yet corroborated the transfer or identified who controls the receiving addresses. Neither source reports a statement from Binance on the deposits.
Scale of the Theft and Entry Point
Crypto Briefing put the total theft at approximately $6.3 billion across around ten blockchains, moved in roughly 20 to 30 minutes. Early investigations point to a compromised laptop belonging to a DevOps engineer, which gave attackers access to Binance's wallet management infrastructure. The system then processed withdrawals without an evident compromise of private keys, according to the same report.
Attribution and Law Enforcement
TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacker group also linked to the Bybit hack. The FBI attributed the theft to the same group on or about October 31, 2026, and listed more than 600 associated addresses. Crypto Briefing notes the three deposit addresses are a potential lead for investigators, since funds reaching a major exchange enter an environment with identity checks and transaction monitoring.
Frozen Assets, Unfrozen Remainder
Stablecoin issuers froze an estimated $2.7 billion to $3 billion in affected assets. Crypto Briefing emphasizes that the attackers have favored Bitcoin and Ether because neither has a central issuer able to freeze tokens, which leaves a large movable portion outside that safeguard.
CoinDesk, in its reporting, describes the 19 wallets holding 18,270 stolen BTC as having taken in nothing since Thursday except payments worth under a dollar, each carrying a message ranging from pleas to laundering pitches to a token promotion. The two accounts frame the remaining BTC differently. Crypto Briefing focuses on laundering routes through intermediaries, while CoinDesk describes the wallets as largely unresponsive to outside contact. CoinDesk's figure is a count of wallets and BTC holdings, and Crypto Briefing does not provide an equivalent BTC total.
Binance Response and Next Steps
Binance said it would cover all customer losses using its Secure Asset Fund for Users (SAFU) and other reserves. Withdrawals resumed in phases starting November 1, 2026, after net outflows of roughly $3.6 billion to $4.9 billion in the initial hours, per Crypto Briefing. Observers will be watching whether Binance or analytics firms confirm the status of the three deposit addresses, whether more stolen funds surface at centralized exchanges, and how much of the haul can be traced.
Why It Matters
For Traders
Unfrozen BTC and ETH from the drain remain movable, so any confirmed exchange deposits could shape near-term sentiment around both assets and Binance flows.
For Investors
The incident raises structural questions about exchange custody and operational security, and the scale of the attributed North Korean activity bears on the sector's risk profile.
For Builders
The breach came through an employee device touching wallet infrastructure rather than private key theft, so operational access controls matter as much as cryptography.
This article is for information only and is not financial advice. Read the full disclaimer.
