Binance hackers' Bitcoin haul tops Coinbase's corporate treasury, Bitquery data shows

Editorial illustration: Gold Bitcoin coins stacked inside and in front of two open safes, with a battered black safe on the left and an intact blue safe on the right.

In brief

  • Bitquery traced 18,270 BTC, worth roughly $1.4 billion, to 19 attacker-linked addresses.
  • Coinbase reported 18,071 BTC combined for investment and operations as of Sept. 30.
  • Bitquery's same Friday snapshot also traced 508,621 ETH to the attackers.
  • Binance said about $3 billion was frozen and pledged to cover all losses.
  • TRM Labs attributed the attack to North Korea's TraderTraitor hacking group.

How the numbers stack up

Bitquery traced the 18,270 BTC to 19 addresses linked to the attacker in a Friday snapshot. According to Bitquery, 17 of those addresses held 1,000 BTC each, and the remaining coins sat in two other wallets.

Coinbase reported holding 17,954 BTC for investment and 117 BTC for operations as of Sept. 30, a combined 18,071 BTC. It isn't a perfect comparison, though. Coinbase's reported holdings don't include the BTC the exchange holds for customers.

BitcoinTreasuries.net ranks Coinbase eighth among publicly traded companies by Bitcoin holdings, based on that 17,954 BTC investment balance.

Put simply, wallets tied to one breach held more Bitcoin than the corporate treasury of the eighth-ranked public company on that list.

The Ether stash is bigger

Bitquery also traced 508,621 ETH to the attackers as of the same Friday snapshot. That's more than the 495,362 ETH BitcoinTreasuries.net attributes to The Ether Machine, which it ranks third among corporate Ether holders.

Not all of it was stolen as ETH. Per Bitquery, the attackers initially took 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens.

What Binance has said

Binance confirmed Friday it had suffered a $6.3 billion hack and said about $3 billion in stolen assets had been frozen, according to Cointelegraph. The exchange pledged to cover all losses.

The BTC came out of Binance hot wallets during a breach that hit nine blockchains in under four hours on Thursday. Binance said investigators had uncovered additional breach points after initially suspecting a compromised laptop belonging to a DevOps engineer.

Blockchain intelligence firm TRM Labs has attributed the attack to North Korea's TraderTraitor hacking group.

Frequently asked questions

How does the Binance hacker's Bitcoin compare to Coinbase's holdings?

Bitquery traced 18,270 BTC to the attackers in a Friday snapshot. Coinbase reported 17,954 BTC for investment and 117 BTC for operations as of Sept. 30, a combined 18,071 BTC, which puts the attackers 199 BTC ahead. Coinbase's figure excludes BTC it holds for customers.

How much Ether did the Binance attackers hold?

Bitquery traced 508,621 ETH to the attackers as of the same Friday snapshot. The attackers initially stole 200,630 ETH and built up the rest by swapping stolen stablecoins and other tokens, according to Bitquery.