Binance must limit what a hacked withdrawal system can spend
At , Binance’s new Bitcoin payout address receives another 2,000 BTC while it still holds 4,007 BTC. The refill raises its balance to 6,007 BTC. After the hack that removed 18,270 BTC from the previous wallet, the amount available for withdrawals—and how refills rebuild it—deserves scrutiny.
Binance adds 2,000 BTC while its payout wallet still holds 4,007 BTC
At , Binance supplies another 2,000 BTC to bc1qhp7…wp5fjj, its new Bitcoin payout address. Since the previous refill, the address has paid out 602.46 BTC and still holds 4,007.25 BTC. The additional funding increases its balance to 6,007.25 BTC.
| Movement | BTC moved | Balance afterwards |
|---|---|---|
| Refill · | +2,000.00 | 4,609.71 BTC |
| Payments before the next refill | −602.46 | 4,007.25 BTC |
| Next refill · | +2,000.00 | 6,007.25 BTC |
The second refill increases the amount held even though thousands of Bitcoin remain from earlier funding. Binance’s restart should be judged by the balance available to its withdrawal system and how additional funding increases it.
Payment demand is substantial. From , this address sends 8,800.85 BTC in 153 transactions. It holds 2,500.34 BTC at the observation time.
| State | BTC sent | Txs | BTC still held |
|---|---|---|---|
| Confirmed | 8,800.85 | 153 | 2,500.34 |
Payments exclude change and transfers to the tracked Binance addresses. Payment totals exclude network fees; balances reflect those fees. Times are confirmed block observations; a transaction can pay many addresses.
Binance announced a phased withdrawal reopening for . Bitcoin is included. The compromised address makes no outgoing transaction from . Binance’s announcement ↗ · The new address’s startup and funding history →
A hot wallet holds funds for everyday payments. Cold storage holds reserves outside that routine payment route. The historical record below follows the compromised Bitcoin address Binance used to receive funding and make outgoing payments.
Assume a withdrawal check fails. The amount already in the wallet and the funds supplied afterwards determine how much is exposed. Binance can reduce both by keeping a defined operating reserve, transferring excess funds to cold storage and stopping refills when the withdrawal route is compromised.
What the Bitcoin record shows
- 66% stayed in the withdrawal wallet. After the cold-storage transfer on , 14,883 BTC (66%) remained in the withdrawal address.
- 19,111 BTC was available when the hack began. The address held 19,111 BTC, 30% above its 30-day average.
- 18,270 BTC left in one block. The 18,270 BTC theft was more than four times the address’s busiest 20 minutes of external payments in the preceding 30 days.
- 970 BTC arrived after the theft began. Eight refills delivered 970 BTC in the 55 minutes after the theft began.
Binance’s last cold transfer left two-thirds of the balance hot
At , the address held 22,523 BTC before the transfer. Binance moved 7,640 BTC to its known cold-storage address in one transaction. The remaining 14,883 BTC stayed hot.
That proportion was typical. Eleven comparable transfers from each moved between 32% and 43% of the address’s balance. Binance had a working route to cold storage, and each use left most of the balance available to the withdrawal process. The amount left behind should be set against expected payment demand. A large transfer to cold storage can still leave a large operating reserve exposed.
The wallet held 19,111 BTC, 30% above its 30-day average
The balance subsequently rose again. When the theft began at , the address held 19,111 BTC. That was 30% above its average of 14,736 BTC over the preceding 30 days. Eleven transfers removed 18,270 BTC, or 95.6% of that balance, in a single block.
High balances are not new for this address. Its monthly highs reached 23,770 BTC in May 2026 and 24,793 BTC in June. In June 2022, it peaked at 152,804 BTC, eight times its balance when the theft began. Risk reviews should track the highest balance alongside the average: the peak shows how much can be exposed in one address at one time.
Monthly averages and highs by UTC calendar month
Average balances reflect time held within each UTC calendar month. October runs from the start of the UTC month to the hack; that interval in your timezone is .
Deposits kept refilling the address after the theft began
From , eight transfers from Binance deposit addresses delivered 970 BTC to the same withdrawal address. From , Binance moved 1,770 BTC to its known cold-storage address in six transfers. By , 0.3744 BTC remained.
- Balance19,111 BTC
Held when the theft began.
- Outflow · theftSame block18,270 BTC
Eleven transfers, 95.6% of the balance.
- Inflow · refills970 BTC
Eight transfers from deposit addresses.
- Outflow · cold storage1,770 BTC
Six transfers to the known cold-storage address.
- Balance0.3744 BTC
Left after the last cold transfer.
Those funds were sent to an address that had just lost 95.6% of its opening balance. A reserve limit needs a matching control on the funds replenishing it. Refills should pause when spending breaches its approved limit or the route is compromised, and resume only with independent approval.
The theft was over four times the wallet’s busiest 20 minutes of payments
During , the address’s busiest rolling 20-minute period of external payments totalled 4,286 BTC. That total excludes change returned to the address and payments to known Binance destinations. The theft moved 18,270 BTC in one block.
A limit on each individual payment leaves room for a series of smaller transfers. Binance should also cap the total paid within rolling time windows and enforce that control independently of the service requesting payments. Historical demand gives those limits a measured basis, with deliberate headroom for peak activity and withdrawals delayed by a suspension.
Transfers to cold storage need their own rules: pre-approved destinations and separate approval. Otherwise, the route used to remove excess funds could become an exemption from the payment limit.
Four controls Binance should enforce on its Bitcoin withdrawal wallets
Smaller operating reserves and independently enforced limits can reduce what a failed withdrawal check exposes. The controls need to cover both payments and the funds supplied to make them.
Set how much stays hot
Hold enough Bitcoin to meet expected payment demand over a defined period, with stated headroom. Recent payment history, including the 4,286 BTC 20-minute peak, gives a measured basis for that size.
Move the excess to cold storage promptly
Start a transfer whenever the balance exceeds the reserve, and move everything above it. After the transfer on , 66% of the balance stayed hot.
Cap total payments
Limit total external payments over rolling time windows, with the limit enforced independently of the withdrawal service. Treat transfers to cold storage as a separately approved route.
Limit and stop refills
Refill toward the approved operating target and within the remaining spending budget. Halt funding when the spending limit is breached or the route is compromised. Require independent approval to resume; the service requesting funds must not approve its own exceptions.
The practical test is how much Bitcoin a failed withdrawal check can reach before a separate control stops the outflow or its funding.
An established funding address supplies a new payout route
The payout address bc1qhp7…wp5fjj first receives funds on . Its funding address, 1Pzaqw9…sENrE7, has activity dating to . The first transfer between them appears at .
Two small outgoing payments precede the distribution phase. A separate exchange with cold storage follows: at , the new address sends 99.80 BTC to the known cold-storage address and receives 100 BTC from it later in the same block. Distribution to multiple recipients begins at .
- Established cold route
3M219KR…DjxRP6Contributes inputs to the funding transaction.
- Held at the funding address
1Pzaqw9…sENrE720,000 BTCArrived at . This output remains unspent; the payouts use other funds.
- Payout address
bc1qhp7…wp5fjj9,201 BTCReceived in 13 transfers from the funding address since .
- Confirmed payments8,800.85 BTC
153 outgoing transactions since ; change and tracked Binance addresses excluded.
The 20,000-BTC arrival was confirmed at . Its transaction includes 17,548.10 BTC from the same cold-storage address used in the earlier reserve transfers. That newly received output remains held while the funding address supplies the payout address from other funds. The funding address’s total balance at the observation time is 24,836.50 BTC. View the funding transaction ↗
Across its full history to the observation time, the payout address receives 11,401.00 BTC in total. The 9,201 BTC shown above is the contribution from 1Pzaqw9…sENrE7; the total also includes funds from other sources. It sends 99.80 BTC to tracked Binance addresses and 8,800.85 BTC elsewhere, pays 0.01664 BTC in network fees, and holds 2,500.34 BTC at the cutoff.
This is the payout address’s first operating period. Its balance peaks at 6,007.25 BTC. During distribution, its time-weighted average balance is 3,185.93 BTC. We will compare later daily and weekly activity with this starting record. The old wallet gives us four specific failures to test for:
How much stays available for payments?
The old failure: 19,111 BTC was available when the hack began, 30% above the preceding 30-day average.
The starting record: the payout balance peaks at 6,007.25 BTC and holds 2,500.34 BTC at the cutoff. The separate funding address holds 24,836.50 BTC. We will follow how long large balances remain and whether later refills increase them.
How much remains after a cold transfer?
The old failure: the last cold-storage transfer left 14,883 BTC—66% of the balance—in the withdrawal address.
We will measure: the amount moved into known cold storage, the balance left behind and how that reserve compares with the route’s own payment demand.
How quickly do payments add up?
The old failure: eleven transfers removed 18,270 BTC in one block, more than four times the old address’s busiest 20 minutes of external payments.
We will measure: cumulative payments per block and rolling 20 minutes, recurring batch sizes, larger individual payments and changes in destinations.
Does funding follow spending?
The old failure: eight refills delivered another 970 BTC in the 55 minutes after the theft began.
The starting record: another 2,000 BTC arrives after 602.46 BTC of payments since the previous refill, raising the balance from 4,007.25 to 6,007.25 BTC. We will test whether that funding pattern persists as payment demand changes.
We will judge the restart by how much remains available for payments, how refills are supplied and how quickly excess funds return to cold storage.