WuBlockchain
ZachXBT says funds from the $6.3 billion Binance exploit and $388 million Bitget exploit were routed through THORChain and commingled at the same address. He said the movement suggests the same actor may be behind both incidents.
Why it matters
The Bitget exploit was previously attributed to North Korea-linked group TraiderTraitor, which has also been linked to the Kelp DAO exploit. The suspected connection raises the stakes of tracing funds across separate attacks.
Market impact
MistTrack says stolen TRX from the Binance incident moved through Bitget Wallet Swap Bridge to an address beginning 0xCd68. On-chain tracking shows that address was previously used by the Phemex hacker. The connections remain an attribution signal, not confirmation of who controlled the funds.
Frequently asked questions
-
What connection did ZachXBT identify between the Binance and Bitget exploits?
He said funds from both incidents moved through THORChain and were commingled at the same address, suggesting a possible shared actor.
-
Which address was involved in the fund trail?
MistTrack traced stolen TRX to an address beginning 0xCd68 through Bitget Wallet Swap Bridge.
-
What was the address's previous connection?
On-chain tracking showed that the address had previously been used by the Phemex hacker.
-
Who had the Bitget exploit previously been attributed to?
The Bitget exploit had previously been attributed to North Korea-linked TraiderTraitor, which has overlap with other incidents including Kelp DAO.
-
Does the shared address confirm the same attacker was behind both exploits?
No. ZachXBT said the commingling suggests the same actor may be responsible, but the reported links do not confirm who controlled the funds.
CoinDesk
CoinTelegraph
TheBlock
WatcherGuru
CryptoSlate