Can Binance's stolen BTC be frozen? 19 wallets hold about $1.4B

What the 19-wallet split actually shows

CoinDesk's reported balances divide into the following groups. These are the article's observed holdings, rather than a continuously refreshed wallet monitor.

Our arithmetic on those rounded figures is 17 × 1,000 + 832.5 + 437.7 = 18,270.2 BTC. That explains why a breakdown with decimals accompanies an approximate headline total of 18,270 BTC. The dollar valuation is also a reporting snapshot; a change in bitcoin's price changes that valuation without moving any coin. [Source for the reported balances](https://www.coindesk.

Splitting one balance across addresses changes the shape of the investigation. It does not, by itself, establish a sale. A reader looking at a chart cannot tell whether the holder sold, moved coins between controlled wallets, or left them untouched. The transaction record is the evidence needed to distinguish those possibilities.

The observation time matters just as much as the amount. “No outgoing transfer at 12:23 SGT” describes a historical check. It cannot establish what happened after that minute. Any follow-up should give a new observation time and a transaction reference, so readers can tell whether the evidence has changed.

Check the direction of an alert as well. A small incoming deposit does not show that the watched holder has spent any bitcoin. CoinDesk noted unsolicited tiny deposits alongside its outgoing-transfer check. Before sharing a wallet alert, establish whether it shows funds arriving or a spend from the balance being investigated. [CoinDesk's distinction between incoming spam and outgoing transfers](https://www.coindesk.

Why USDT and USDC could be frozen

Stablecoins such as USDT and USDC have issuers with controls over their token contracts. Those controls let the issuers block relevant balances. Tether's chief executive reported freezing more than 1.567 billion USDT connected to the incident. TRM's investigation separately records Circle freezing 823 million USDC in the main receiving wallet. These are attributed freeze reports at their respective stages of the response, not a final combined recovery account. Tether's statement. TRM's investigation.

Native BTC has no corresponding issuer-operated blacklist. An exchange can restrict an account or refuse a deposit, but that does not give it authority to rewrite bitcoin's ledger or immobilize coins still controlled elsewhere. A freeze at a service and a freeze built into a token contract are different interventions.

This also explains why a frozen amount should not be described as money already returned to customers. Preventing further movement is one stage. Establishing control, resolving ownership and returning assets are further stages. Look for confirmation of the actual recovery stage before treating frozen funds as returned money.

For someone with funds on Binance, the practical question is whether their own balance and transfer records match the service's official updates. A large freeze headline does not resolve a particular pending withdrawal. Keep its transaction reference and status available when contacting support through the application you already use.

Traceable transactions, uncertain identities

Following a bitcoin transaction means following public movements between addresses. It does not automatically identify the person operating an address. The distinction becomes particularly important when a claim names an exchange deposit address or a broker: the attribution needs evidence beyond an unfamiliar label on a screenshot.

TRM attributes this attack to North Korea's TraderTraitor group with high confidence. Its report also connects that group to the February 2025 Bybit theft of about $1.5 billion. Those are TRM's investigative assessments; a reader should preserve the attribution when discussing the alleged attacker. [TRM's attribution and comparison](https://www.trmlabs.

The appropriate watchlist is therefore evidence-led. Does a reported transaction actually spend one of the watched holdings? Where do the outputs go? Is a destination independently associated with a custodial service? Has that service confirmed an intervention? Those questions separate an observable transfer from assumptions about who received it or what happened next.

An over-the-counter channel is relevant as a possible point where an intermediary can act. It is not evidence that these particular bitcoins have already reached such a channel. Naming a destination prematurely could turn a speculative address label into an accusation against an unrelated business.

Why the loss estimates differ

TRM estimates approximately $6.36 billion across ten chains, valuing transfers when they occurred. Binance's preliminary statement puts the overall impact around $6.3 billion. The Reuters item collected on Techmeme provides another account of the incident and TRM's attribution. [TRM's scope and valuation method](https://www.trmlabs. Reuters coverage collected by Techmeme.

Those totals describe the wider incident, while the 19 wallets describe its bitcoin portion. They should not be added together. Earlier estimates also need their original chain coverage and observation time before a reader can compare them fairly with a later total. A lower headline alone does not establish that the difference was recovered.

Binance says its initial investigation suggests a compromised DevOps engineer's laptop allowed access to a service container and unauthorized withdrawal submissions. It says it has found no evidence of a wallet private-key leak and promises a technical post-mortem. The company also pledges to cover all losses. These remain company statements about the investigation and response, rather than an independently completed technical audit or proof that every customer case has been resolved. Binance's preliminary findings.

Liquidations show a separate kind of damage

NexuAlpha's snapshot at 13:43:49 SGT on October 30 recorded $764,146,010 in observed liquidations over 24 hours across Binance and OKX: $649,346,849 in longs and $114,799,161 in shorts. The four-hour window showed $42,744,885, comprising $16,884,249 in longs and $25,860,636 in shorts. Timestamped liquidation data.

These figures measure forced closures of leveraged positions in the named venues. They are not stolen-wallet balances, and they cannot be added to the hack estimate. Their rolling windows also include trading outside the exact incident interval, so the totals alone cannot establish how much liquidation activity the security incident caused.

The different long/short mix across those windows is useful context for an open position. A trader can be exposed to a reversal even while reading about a theft that happened earlier. Check your position size, margin and liquidation level in your own trading interface. Use the funding-rate board to compare the ongoing cost of holding a perpetual position, keeping that cost separate from the security investigation.

For subsequent updates, use the timestamp displayed on the liquidations page. A refreshed total describes a new rolling window. It should not silently replace the dated numbers quoted here, and a change in it does not establish movement from any of the 19 bitcoin wallets.

What this means for you

• Check Binance through your usual application or saved address. Review pending deposits and withdrawals, then compare their status with official service updates.
• Keep the transaction reference and time for a transfer that needs support. A wallet-tracking headline cannot settle an individual account record.
• Monitor sourced reports for outgoing transactions from the 19 holdings. Ask for the transaction reference, observation time and basis for any exchange or OTC attribution.
• Review leverage and margin separately from the wallet investigation. Liquidation data and funding rates answer trading questions; they do not certify custody safety.

Treat unsolicited “Binance compensation” links or direct messages as suspect. Do not provide a seed phrase, approve a wallet connection or send an unlocking payment to claim compensation. Binance's own response directs users to its official channels. Reach support from the application you normally use instead of following a message from a supposed recovery agent. Binance's loss-coverage and channel statement.

Quick answers

Can the issuer freeze these bitcoins?

There is no bitcoin issuer with a token-contract blacklist. A custodial service can act on assets or accounts it controls, which is why a verified destination matters to the investigation.

Does a transfer mean the attacker has sold?

A transfer establishes movement. Establishing a sale needs additional evidence about the destination and transaction's purpose. Avoid treating either a price drop or an address label as a sale receipt.

Have all losses already been reimbursed?

Binance has pledged to cover them. That statement is different from evidence that all reimbursements and pending transfers have been completed. Check your own account and subsequent official updates.

What would materially change this story?

A verified outgoing spend, a supported link to a service that can intervene, confirmed recovery, or a completed technical post-mortem would add evidence. Until then, keep the early-Friday wallet observation, the issuer freezes and the current market data on their own timelines.