- Trending
- Comments
- Latest
The Bit Gazette · Original reporting
Not one of the 19 bitcoin addresses the FBI linked to the Binance theft has spent a single satoshi, a Bit Gazette review finds. They hold 18,270 BTC with no pending transactions.
The FBI attributes the theft of more than $6 billion in digital assets to North Korea’s TraderTraitor activity. The 18,270 BTC covers only the bitcoin portion of that haul, which the bureau listed across 19 addresses in its October 31 alert.
Our findings · November 1, 2026
Combined confirmed balance
18,270.20101409 BTC
Snapshot: 15:27 UTC / 16:27 WAT · November 1, 2026. These findings cover the 19 listed Bitcoin addresses only.
The Bitcoin remained unspent at these addresses. The returned summaries showed no confirmed spent outputs. At the time checked, there was no outgoing transaction from these destinations to follow to an exchange, mixer or other service.
The wider operation has not necessarily stopped. The FBI says investigators have seen stolen assets converted primarily into ETH. Our Bitcoin address check does not establish the status of the rest of the stolen portfolio.
Identification is not recovery. The FBI urges crypto service providers to block transactions involving the listed addresses. A zero-spending balance does not establish that the funds have been frozen or recovered.
Seventeen addresses hold roughly 1,000 BTC each. The other two hold approximately 832.50 BTC and 437.70 BTC. The table below shows every address checked, with its confirmed balance and a link to the explorer.
The combined balance should not be read as the exact stolen principal. It includes any later deposits, and The Bit Gazette has not yet reconciled each original funding output.
The investigation record
All 19 addresses returned zero confirmed spending and zero pending transactions. Open the table to inspect the balances and source links.
Source: mempool.space summaries retrieved through Firecrawl’s data provider. Observations: November 1, 2026, 15:27:26–15:27:27 UTC. Scroll the table horizontally on smaller screens.
An outgoing transaction from any of the 19 addresses would open a new trail. Reporters and analysts would need to establish the amount, the receiving addresses and whether they link to a known service. A transfer alone would not prove the bitcoin was sold.
The zero-spending counters do not explain why the funds are idle. These records cannot show the attackers’ intentions, whether they still control the keys, or whether off-chain arrangements exist.
The Bit Gazette checked all 19 Bitcoin addresses from the FBI’s October 31 alert using mempool.space summaries retrieved through Firecrawl’s data provider. The provider timestamps fall between 15:27:26 and 15:27:27 UTC on November 1, 2026. We assessed confirmed balances, funded and spent output counters, and pending activity, and summed the balances in integer satoshis before converting to BTC.
Attribution of the addresses to the theft comes from the FBI; our original contribution is the address-by-address review and aggregation of the explorer records.
We did not run an independent Bitcoin node, reconstruct the initial split, or cross-check a second explorer. The observations were taken sequentially within approximately one second, rather than at a fixed block height. Findings apply only to that observation window.
Related reporting: Our original report on the split across 19 Bitcoin addresses.
Copyright © 2025 - The Bit Gazette.
