Attacker’s 18,270 BTC Exceeds Coinbase’s Corporate Holdings

What happened: Blockchain analytics firm Bitquery traced 18,270 BTC, valued at approximately $1.4 billion in the reporting, to 19 attacker-controlled addresses early Friday. Of those wallets, 17 held exactly 1,000 BTC each, with the remaining balance distributed between the other two addresses; reporting also identified an attacker-controlled Ether balance exceeding 500,000 ETH. Coinbase’s disclosed September 30 holdings comprised 17,954 BTC for investment and 117 BTC for operations, totaling 18,071 BTC—a corporate balance the attacker’s traced holdings exceeded by 199 BTC.

Why it matters: The Coinbase comparison communicates the scale of the theft, but its scope is essential: these are Coinbase’s corporate holdings, excluding Bitcoin held in custody for customers. Native Bitcoin also lacks the issuer-controlled freezing mechanism available to stablecoins such as USDT and USDC, making identification of the 19 addresses different from obtaining control of their balances. The distribution therefore puts a practical limit on interpreting Binance’s aggregate freeze announcement: restrictions affecting some stolen assets do not demonstrate that the attacker’s Bitcoin has been immobilized, and a visible wallet balance alone establishes neither a sale nor an imminent market liquidation.

Sources: Cointelegraph; CoinDesk; The Block.