Binance Moves $1.69B In Bitcoin After North Korea Hack

Binance moved 21,750 Bitcoin worth about $1.69 billion from a cold wallet to hot wallets to restore operational liquidity after a multibillion-dollar hack that U.S. authorities attributed to North Korea.

Key Takeaways

• Binance moved 21,750 Bitcoin worth about $1.69 billion from a cold wallet to hot wallets on Sunday
• OnchainLens posted the transfer and identified the sending wallet as a Binance cold address
• U.S. authorities identified North Korea as the actor in the attack disclosed on Friday
• Earlier reports pegged the theft above $6 billion, making it one of the largest attacks to hit a digital asset venue

OnchainLens posted the transfer in the past few hours and identified the sending wallet as a Binance cold address. The platform runs one of the world’s largest cryptocurrency exchanges, and cold wallets are offline reserves while hot wallets handle day-to-day withdrawals.

A separate on-chain record shows the source address and the movement path cited in the X post.

Withdrawals had already resumed after the breach, but moving this much BTC into warmer operating wallets points to a more active payout phase than a routine treasury shuffle.

Hot Wallets Matter When Claims Start Moving

A hot wallet is simply an internet-connected wallet that can sign transactions quickly. Exchanges keep only a slice of reserves there because speed helps customer withdrawals, but internet access also makes those wallets more exposed than deep cold storage.

That distinction matters after a hack.

U.S. authorities identified North Korea as the actor in the attack disclosed on Friday, and on-chain traces of the transfer path provide concrete evidence tying the exchange’s wallets to operational movements. If the platform is making users whole, it needs coins where finance and operations teams can send them fast.

Also Read: $2.8B Pours Out Of Binance Wallets In One Night In Suspected Hack

From Hack Shock To Balance Sheet Repair

Sunday’s transfer follows the attack disclosed on Friday, when North Korea was identified by U.S. authorities as the actor behind a theft that the exchange said disrupted withdrawals and forced emergency controls.

Earlier reports pegged the theft above $6 billion, making it one of the largest attacks to hit a digital asset venue.

After a major breach, an exchange has to prove two things at once. It must restore customer access, and it must show it still controls enough reserves to absorb losses.

Moving coins into operating wallets is one of the first visible on-chain signs of that repair cycle.

Binance Bitcoin Move Puts Liquidity Under Watch

The next thing traders will watch is whether the platform sends these funds onward in smaller batches to user-facing wallets or clusters tied to withdrawals. If those patterns appear, the Binance Bitcoin Move will look less like internal housekeeping and more like active claims processing.

The other question is reserves.

A transfer between exchange-controlled wallets does not change total holdings by itself. What matters is whether later on-chain flows show coins leaving the platform faster than they return.

In the hours after a hack, wallet geography becomes a public balance sheet.

Why 21,750 BTC Is The Telltale Number

Binance uses different wallet tiers for different jobs, and the size of this transfer is what makes it notable. Twenty-one thousand seven hundred fifty BTC is too large for routine user withdrawals and too targeted for a random housekeeping move.

For operations staff, shifting that much BTC into more accessible addresses is the kind of step that shortens payout time but slightly raises operational risk because hot wallets are built for speed, not maximum isolation.

For customers, the key change is practical. Before the transfer, reserves sat farther from the withdrawal layer.

After it, more BTC appears positioned closer to where the exchange can send coins out.

The next clear signal will be transaction fan-out, when one large input breaks into many smaller outputs, or an exchange statement matching those on-chain flows.

Read Next: ChatGPT Spreads To 165 Work Tasks Across 100 Countries