The attackers held 18,270 BTC early Friday, topping Coinbase’s reported corporate holdings, and an Ether stash exceeding 500,000 ETH.

The attackers behind the $6.3 billion Binance hack held more Bitcoin on Friday than crypto exchange Coinbase’s holding for investment and operation at the end of September.

Blockchain analytics firm Bitquery traced 18,270 Bitcoin (BTC), worth roughly $1.4 billion, to 19 addresses linked to the attacker.

Coinbase reported holding 17,954 BTC for investment and 117 BTC for operations as of Sept. 30, a combined 18,071 BTC. The Binance hacker’s haul exceeded that total by 199 BTC. Coinbase’s holdings does not include the BTC that the exchange holds for customers.

BitcoinTreasuries.net ranks Coinbase eighth among publicly traded companies by Bitcoin holdings, based on its 17,954 BTC investment balance.

Binance confirmed Friday that it had suffered a $6.3 billion hack and said about $3 billion in stolen assets had been frozen. The exchange pledged to cover all losses.

Blockchain intelligence firm TRM Labs has attributed the attack to North Korea’s TraderTraitor hacking group. Binance said investigators had uncovered additional breach points after initially suspecting a compromised laptop belonging to a DevOps engineer.

According to Bitquery, 17 of the attackers’ Bitcoin addresses held 1,000 BTC each, while the remaining coins sat in two other wallets. The BTC was stolen from Binance hot wallets during a breach that affected nine blockchains in under four hours on Thursday.

Bitquery also traced 508,621 Ether (ETH) to the attackers as of the same Friday snapshot, exceeding the 495,362 ETH that BitcoinTreasuries.net attributes to The Ether Machine, which ranks third on its list of corporate Ether holders.

The attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens, Bitquery added.

Live updates: Binance uncovers more breach points in $6.3B hack