Stolen Funds from Major Exchange Hacks Converge, Unmasking Potential Single Attacker

In a significant breakthrough, on-chain investigator ZachXBT has uncovered a critical link between two major cryptocurrency exchange hacks. The stolen funds from Binance's historic $6.3 billion security incident and Bitget's more recent $388 million breach have shockingly intersected on the blockchain.

Identical Money Laundering Path Points to Coordinated Action

ZachXBT's analysis of blockchain data reveals that the massive sums stolen from these separate exchanges, at different times, were ultimately funneled to the same address for mixing: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. Both fund movements utilized the cross-chain protocol THORChain, showcasing an unusually consistent money laundering methodology that stands out in complex on-chain transactions.

Connecting the Dots: Overlap with North Korean-Linked Hacker Group

Further investigation strengthens the connection. The Bitget exploit had previously been attributed by the security community to a hacker group known as "TraiderTraitor," which has alleged ties to North Korea. ZachXBT notes that this group's patterns of activity show overlap not only with the Bitget case but also with prior incidents like the Kelp DAO attack.

The convergence of Binance hack funds with Bitget's loot on-chain virtually eliminates coincidence. The mounting evidence points to a sobering conclusion: these two major security events that rocked the crypto industry likely originated from the same, or a tightly coordinated group of, sophisticated threat actors.

Implications for Crypto Security

This discovery presents severe challenges for the security posture of cryptocurrency exchanges and DeFi protocols:

  • Sustained Campaigns: Hacker groups demonstrate the capability to launch sequential attacks against multiple top-tier platforms.
  • Professionalized Obfuscation: The use of cross-chain tools like THORChain and mixing services significantly complicates fund tracing.
  • Connected Threats: Linking isolated security incidents helps build a more comprehensive threat profile for proactive defense.

ZachXBT's disclosure not only exposes the extensive damage a single actor can inflict but also serves as a stark reminder for all projects to strengthen security through ecosystem-wide collaboration, as attackers consistently target multiple points within the landscape.