21 BTC

Binance hack 2026: where the stolen bitcoins go

On 29 Oct 2026 at 20:20 UTC, 18,270.2 BTC left a Binance hot wallet in 11 transactions to one address. Crystal Intelligence labels the receiving cluster a potential Binance thief. Within minutes the coins were split into 19 addresses. We follow every move on-chain.

Live tracker · Investigation #1 · Binance hack

Crystal Intelligence flagged the likely Binance hacker wallet. We follow its 18,270 BTC on-chain, block by block.

Still held by the hacker · 19 addresses
As of 1 Nov, 20:10 London (blockstream.info).
18,270.20 BTC
≈ $1.42 B · BTC part of the hack · at $77,709
of 18,270.2 BTC taken on 29 Oct
Since the hack
2d 23:51:20
Left the trail
0.0 BTC
Last movement
29 Oct, 20:48 London437.7 BTC → bc1qxg0l4p…y7s9ra
On the flagged address
0.00 BTC
See where every coin went →Check your bitcoins on 21btc.cc →mempool.space ↗

Address bc1q0mtc2f…hl2mnm is flagged by Crystal Intelligence as the likely Binance hacker wallet. On-chain data: blockstream.info, as of 1 Nov, 20:10 London. A tracker, not advice.

Update · 31 Oct, 14:51 London · Binance's own funds, not the hacker's

$581M of Bitcoin just left Binance's emergency fund. Binance says why, not who now holds it

7,499 BTC
left Binance SAFU in one transaction
~$581.4M
value at the time (Whale Alert)
7,500 BTC
on the new address now (live)
326 BTC
change sent back to SAFU

At 31 Oct, 14:51:41 London (block 973,984) Binance's SAFU emergency fund (1BAuq7Vho2…CmWQkD) sent 7,499 BTC to a fresh address with no public label, 165EurvYDf…3SMmee. Six minutes earlier a 1 BTC test payment went to the same address. Nothing has left the new address so far. Transaction ↗

Explanation statusExplained by Binance. At 14:30 London, Security Incident Update #3 said part of SAFU would be deployed over the next 24 hours to buy the last 10% of the stolen assets, and named 1BAuq…QkD as the SAFU Bitcoin wallet. At 16:15 London Binance posted that “this was the large 7,499 BTC transfer”. Binance has not said who controls 165Eur…Mmee.

This is Binance's own money, not the hacker's. The 19 Bitcoin addresses holding the stolen coins still hold 18,270.2 BTC and have not moved. Whale Alert flagged two TRX moves from the hack funds today: 120M TRX at 14:50 and 158.2M TRX at 18:44 London. We see no on-chain link between the SAFU transfer and the hacker's addresses.

SAFU's Bitcoin wallet still holds 7,500 BTC and Binance said deployment may take up to 24 hours, so more may move. Binance says it will refill SAFU to about $1 billion and reopen withdrawals on Sunday 1 Nov. Not investment advice.

  • mempool.space ↗: The 7,499 BTC transaction, block 973,984
  • Whale Alert ↗: Alert at 14:57 London: SAFU to unknown wallet, $581,377,429
  • Binance ↗: 16:15 London: “SAFU fund transfer is complete”
  • Binance ↗: Security Incident Update #3: 90% replenished, partial SAFU deployment

Statements and balances checked 31 Oct, 19:55 London. The new address's balance above is read live from blockstream.info.

The flagged address

bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm

Binance Hack 2026 — potential thief (Crystal) · Crystal Intelligence ↗ · mempool.space ↗ · AML check

It received 18,270.2 BTC in 11 transactions from Binance (bc1qm34lsc…j77s3h), all in block 973,732, and now holds 0 BTC: everything was passed on within minutes.

11 incoming transactions from Binance

Every road the coins took

35 transfers to 29 addresses over 4 hops. Tap a line to fold or unfold it. Trail updated 31 Oct, 13:08 London.

Binance → bc1q0mtc2f…hl2mnm (18,270.2 BTC)

Where the coins are now

AddressHopBTCStatus
bc1qxrxujw…hs968s11,000holding, not moved
bc1qepc70u…hs4lag21,000holding, not moved
bc1qnq6jj9…0k8t3s11,000holding, not moved
bc1qdfhmlr…3g88gw21,000holding, not moved
bc1q42flha…5wlsyx31,000holding, not moved
bc1qz8hdwv…gxupdp31,000holding, not moved
bc1q0ts8ga…mkmfv311,000holding, not moved
bc1q2wvz0k…veznn621,000holding, not moved
bc1qm2j6v3…9wjaat21,000holding, not moved
bc1qjwdw6v…mxnz7w11,000holding, not moved
bc1qalwnl7…69tca821,000holding, not moved
bc1qs3aej5…577s5611,000holding, not moved
bc1q63qrfr…atsjxp41,000holding, not moved
bc1qs6xnmh…l87w3v21,000holding, not moved
bc1qg3nrzp…6n3t5331,000holding, not moved
bc1qf5cyvv…l8a35u31,000holding, not moved
bc1qm8v88m…crs2l831,000holding, not moved
bc1qrg025e…hn6zyt2832.5holding, not moved
bc1qxg0l4p…y7s9ra1437.7holding, not moved

No coins have reached an address we know as an exchange, mixer or bridge.

Sources and method

We start from the flagged address and follow every output of 10 BTC or more, up to 12 hops, using the public mempool.space API. A trail stops when coins reach an address with a known label from our database (exchanges, custodians, services). We do not guess owners: unlabeled addresses are marked unknown. The scoreboard reads live balances every minute; the full trail is rebuilt by a data job.

TRM Labs and Chainalysis link the attack to North Korea’s TraderTraitor (Lazarus). Labels are third-party and may change.