Blockchain analysis of the suspected Binance hack indicates that the stolen bitcoin has been divided among 19 separate wallets. According to the trace, the full haul of 18,270 BTC is held across those addresses, and the coins have not moved since Thursday night. The reporting values the holdings at roughly $1.4 billion.
The distribution of the funds is notably regular. Seventeen of the 19 wallets each hold exactly 1,000 BTC, which accounts for most of the total, while the remaining two addresses hold the balance of the coins. The coverage describes these as wallets that no one can freeze, a reference to the fact that bitcoin, unlike some stablecoins, has no issuer able to blacklist an address.
That distinction helps explain activity seen elsewhere on-chain. Records on the Ethereum block explorer Etherscan show wallets linked to the suspected hack exchanging stablecoins for Ethereum on decentralized exchanges. Stablecoins issued by centralized companies can often be frozen by their issuers, so converting them into Ether moves value into an asset that is harder to block. Reports characterize this as the hacker searching for exit routes from the stolen funds.
The same reporting notes that some decentralized exchanges have paused markets in response. Decentralized exchanges are trading venues run by smart contracts rather than a central operator, and they are a common way for holders to swap one token for another without an intermediary approving the transaction. Pausing markets is one step platforms can take when funds tied to an exploit begin flowing through them.
The sources do not provide details on how the breach occurred, what other assets were taken beyond the bitcoin and stablecoins described, or what steps Binance itself has taken. They also do not say whether any of the funds have been recovered. Those points remain outside what the available reporting establishes.
For now, the on-chain picture is of a large, evenly split bitcoin position sitting idle in 19 addresses, alongside smaller, active conversions of freezable tokens into Ethereum. Further movement of the bitcoin would be visible on the public blockchain, which is how the current trace was assembled.
Why it matters for traders
A theft of this size, measured at about $1.4 billion in bitcoin, puts a large pool of coins under public watch, and any movement of those wallets is visible on-chain. The stablecoin-to-Ether swaps and the pauses at decentralized exchanges show how stolen funds interact with market infrastructure and where freezing powers exist. Traders follow such flows because they reveal how platforms and issuers respond to security incidents.