Binance Hackers Now Hold More Bitcoin Than Coinbase's Corporate Treasury

The attackers behind the $6.3 billion Binance hack held more Bitcoin on Friday than Coinbase keeps in its entire corporate treasury. Blockchain analytics firm Bitquery traced 18,270 BTC, worth roughly $1.4 billion, to 19 addresses linked to the attacker. That total exceeds Coinbase's combined corporate holdings of 18,071 BTC by exactly 199 coins.

The comparison lands hard because Coinbase is one of the largest publicly traded crypto companies in the world. Coinbase reported holding 17,954 BTC for investment and 117 BTC for operations as of Sept. 30. BitcoinTreasuries.net ranks the exchange eighth among publicly traded companies by Bitcoin holdings, based on that investment balance. Coinbase's corporate figure does not include the Bitcoin it custodies for customers.

A hacker now out-ranks a Nasdaq-listed corporate treasury. That is the scale of what Binance disclosed.

What exactly did the attackers take?

Binance confirmed Friday that it suffered a $6.3 billion hack and said roughly $3 billion in stolen assets had been frozen so far. The exchange pledged to cover all customer losses.

According to Bitquery, 17 of the attackers' Bitcoin addresses held 1,000 BTC each. The remaining coins sat in two other wallets. The Bitcoin was drained from Binance hot wallets during a breach that hit nine blockchains in under four hours on Thursday.

The speed matters as much as the size. Nine chains compromised in under four hours suggests coordinated infrastructure access, not a single opportunistic theft.

The attackers' Ether position is just as striking. Bitquery traced 508,621 ETH to the attackers as of the same Friday snapshot. That exceeds the 495,362 ETH that BitcoinTreasuries.net attributes to The Ether Machine, which ranks third on its list of corporate Ether holders.

The attackers did not steal all that Ether at once. They initially took 200,630 ETH, then accumulated the rest by swapping stolen stablecoins and other tokens, according to Bitquery.

Who is behind the attack?

Blockchain intelligence firm TRM Labs has attributed the attack to North Korea's TraderTraitor hacking group. The attribution fits a pattern of state-linked crypto theft that has plagued exchanges for years.

Binance said investigators uncovered additional breach points after initially suspecting a compromised laptop belonging to a DevOps engineer. The investigation has widened from a single device to a broader set of intrusion vectors.

For Binance, the operational consequences are layered. Roughly $3 billion in stolen assets is already frozen, which limits what the attackers can liquidate. But the traced 18,270 BTC and 508,621 ETH remain visible on-chain, and every swap or transfer generates new forensic leads for the firms tracking them.

What does this change for the market?

The breach resets expectations for how much a single attack can move. A $6.3 billion theft, executed across nine blockchains in under four hours, is now the reference case for hot-wallet risk at major exchanges. Firms that custody customer assets will face harder questions about how much they keep in internet-connected wallets versus cold storage.

It also puts corporate treasury benchmarks in an awkward light. When a hacking group's haul outranks the BTC balances of Coinbase and the ETH holdings of The Ether Machine, treasury rankings stop being a pure measure of institutional conviction.

The next test is the recovery window. With $3 billion frozen and investigators still mapping breach points, the coming weeks will show how much of the remaining $3.3 billion the attackers can actually move through liquidity without being intercepted.