Binance hacker's bitcoin now sits in 19 wallets no one can freeze
The attackers hold 18,270 BTC, more than Coinbase reports owning, while a sell-off in a little-known 2017 token shows how they are cashing out smaller coins.
The bitcoin taken in the Binance hack has gone quiet. It sits in a tidy set of wallets that no company or authority has the technical power to freeze.
What happened
The attackers held 18,270 BTC early on Friday, more bitcoin than Coinbase reports holding on its own corporate balance sheet. They also held an ether stash of more than 500,000 ETH.
A trace of the blockchain shows the bitcoin, worth about $1.4 billion, split across 19 wallets. Seventeen of them hold exactly 1,000 BTC each, and none of the coins has moved since Thursday night.
Elsewhere, the hacker sold FUN, a little-known token from 2017, along with other small tokens. Those markets were too thin to absorb large sales, and FUN’s price crashed by about 90%.
Background
Stablecoins such as USDT and USDC can be frozen by the companies that issue them, which is why large amounts of stolen stablecoins were locked within hours. Bitcoin has no central issuer, so once it sits in a wallet the attacker controls, no one can block it on the network itself.
What investigators can do is watch the wallets. Any attempt to move the coins to an exchange, a mixer or a cross-chain bridge becomes visible, and services that cooperate with law enforcement can refuse or freeze the deposit.
Why it matters
The split into round 1,000 BTC wallets suggests the attackers are organising the funds to move later, not in a hurry. Large hacks have shown that stolen bitcoin can sit untouched for months or years.
The FUN crash shows the other side: when attackers do sell, holders of small, illiquid tokens can suffer heavy losses they had nothing to do with.
Written by Tech Security with AI assistance. Not financial advice. See our disclaimer.