18,270 BTC left a Binance hot wallet in one transaction, and no one can freeze it. Censorship resistance cuts both ways, and so does "not your keys"

Of the ~$6.3B taken from Binance on Thursday, the bitcoin is the part no company, issuer or council can claw back.

What the on-chain data shows (via TRM Labs):

• At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC (~$1.47B) to an attacker address in a single transaction
• In that same block, the attacker started splitting it into round 1,000 BTC and 100 BTC chunks, a classic peel chain to make tracing harder
• Analysts (TRM, Chainalysis) attribute the hack to North Korea's TraderTraitor group with high confidence

Precedent isn't encouraging. After the $1.5B Bybit hack in Feb 2025, Bybit said 18 months later it had recovered about $48.4M, with another $30.5M frozen.

I think there are two honest takeaways, and they pull in opposite directions:

1. The protocol did exactly what it's designed to do. A valid signature moves coins, full stop. No one can reverse a transaction because it's inconvenient, and that's the same property that protects your coins from seizure. You don't get one without the other.
2. "Not your keys, not your coins" just got a $6B example. Binance says it'll cover every loss from SAFU and company funds, and withdrawals are paused for ~45 hours. Users are fine if that holds. But they're relying on a promise, not on keys.

What I'd actually like to hear from people here:

• Can the 18,270 BTC realistically be cashed out with exchanges and OTC desks watching the peel chain outputs?
• Does this push you toward moving coins off exchanges, or do you think the "exchange covers it" outcome proves custodial is fine for most people?

Sources: TRM Labs on-chain analysis; BBC live coverage for Binance's statements.