Binance Hack: 18,270 BTC Stolen, More Than Tesla and El Salvador Holdings

A total of 18,270 bitcoin (BTC) worth about US$1.4 billion, or Rp21.8 trillion (at an exchange rate of Rp15,600), moved from Binance's hot wallet to an unknown address on Thursday (30/10) local time. That amount is larger than Tesla's total holdings (11,509 BTC) and double El Salvador's national reserve (7,820 BTC), making it one of the largest digital asset hacks in history.

According to data compiled by CoinDesk, the theft is just 442 BTC short of SpaceX's holdings of 18,712 BTC. Both Tesla and SpaceX disclosed their bitcoin positions in quarterly reports as of 30 September released this month. Meanwhile El Salvador, which began accumulating bitcoin in September 2021, has now lost most of its reserve compared with the proceeds of the cybercrime.

Blockchain intelligence firm TRM Labs assesses with a high degree of confidence that the attack was carried out by TraderTraitor, a North Korea-backed hacking unit. The FBI previously accused the same group of being responsible for the theft of US$1.5 billion from Bybit in February 2025. To date, Binance has not identified the perpetrators behind the incident.

The transaction was detected at around 16.20 ET on Thursday. The hot wallet—an account connected to the internet to process customer withdrawals—sent the coins to a new address through 11 separate transactions. The receiving address then split the funds across 19 wallets, and by early Friday none had moved its funds. This pattern indicates an effort to make tracking and freezing assets more difficult.

By Saturday morning Asia time, Binance reported that about US$3 billion of the total US$6.3 billion taken had been frozen on-chain. Most of the protection came from stablecoin issuers such as Tether and Circle, which have mechanisms to block transfers from certain addresses. Exchanges and custodians can also still refuse deposits of stolen bitcoin, giving investigators a chance to intercept the funds when the perpetrators try to cash out.

"We found additional points of compromise, but there is no evidence that the wallet's private key leaked," Binance said in an update on Friday, as quoted from their official report.

Binance said it has set aside more than US$6.34 billion in corporate funds, including US$5 billion already available in the affected cryptocurrencies. The shortfall is being covered through open-market purchases and private negotiations. Withdrawals remain suspended during the security review, and the exchange plans to release the latest proof-of-reserves results on Monday (2/11) to show its asset position and guarantee of user balances.

In the Indonesian context, the incident is an alarm for regulators and players in the domestic crypto asset industry. The Commodity Futures Trading Regulatory Agency (Bappebti) recorded national crypto asset transaction value reaching Rp211 trillion in the first half of 2025, with bitcoin as the dominant instrument. Reliance on global exchanges such as Binance—which has a large user base in Indonesia—raises the risk of contagion if a similar incident occurs. Cybersecurity observers stress the importance of periodic audits of hot wallets and the implementation of customer fund segregation, as mandated by Bappebti Regulation No. 8/2021.

Going forward, the case will test the effectiveness of cross-jurisdictional collaboration in freezing digital assets. Binance promises to release more transparent proof of reserves, but the big question remains: is the global crypto industry ready to adopt stricter security standards, or will billion-dollar hacks keep recurring?