Share this article
$6 Million in Stolen Binance Bitcoin Is On the Move Again
A series of hops and "payments" shows that the Binance hackers are working to access some of their stolen millions.
By John Biggs
Updated Sep 13, 2021, 9:18 a.m. Published Jun 13, 2019, 8:30 p.m.
Hackers are now accessing wallets containing cryptocurrency stolen from Binance in May. Coinfirm, the company that tracked the original few moves in early May has spotted a massive outflow from the original hoard of wallets created on May 7, 2019.
Coinfirm's co-founder., Grant Blaisdell, wrote:
STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters
The attack was conducted using diversified techniques including viruses and phishing. According to Binance, stolen funds constituted approximately 2 percent of total BTC holdings of the exchange. In order to prevent user’s funds from being affected and guarantee stable work of the platform, Binance used its SAFU fund to cover the loses. The Secure Asset Fund for Users was established on July 14, 2018 and consists of 10 percent of all trading fees.
According to Coinfirm, the hackers then moved 1,060.64474480 BTC or $6,148,122.40 in a number of hops, shedding value each time. On June 7, 2019, the hacker moved the $6 million from this wallet, called bc1q2r..., to this wallet, bc1q65..., shedding an odd $15.84 dollars into this small wallet and adding $2 million to the total. It's not clear why this small an amount "hopped" out of the wallet.
The next hop moved 1,040.95915580 BTC ($8,242,840.00) into this wallet, shedding $155,861.00 into another wallet, 1JSfJ.... This shows a concerted effort to break up the bigger wallets into smaller chunks.
Finally, Coinfirm saw a final hop of 1,021.53182514 BTC ($8,089,010.00) into this wallet, again shedding $153,835.00 into this wallet. The remaining BTC ended up in "bc1qcgwn2nv906k3rws803zhxwq3crfgjvnzjejgyq" and has not moved since.
This pattern of hops and "shedding" suggests either some sort of side payment to other parties or further efforts at laundering the cash using what appears to be a series of calculated moves aimed at scrambling the source of the funds. Given each of these wallets are now being watched carefully by legitimate exchanges it could be quite difficult - but not impossible - to convert these wallets to fiat.
Image via Shutterstock.
More For You
What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
Japan’s Higher Rates Puts Bitcoin in the Crosshairs of a Yen Carry Unwind
A stronger yen typically coincides with de-risking across macro portfolios, and that dynamic could tighten liquidity conditions that recently helped bitcoin rebound from November’s lows.
What to know:
- The Bank of Japan is expected to raise interest rates to 0.75% at its December meeting, the highest since 1995, affecting global markets including cryptocurrencies.
- A stronger yen could lead to de-risking in macro portfolios, impacting liquidity conditions that have supported bitcoin's recent recovery.
- Governor Kazuo Ueda indicated a high probability of a rate hike, with officials prepared for further tightening if their economic outlook supports it.
Top Stories
