Onchain forensics traced Binance's stolen 612.7M $USDT + 46.4M $TRX through Tron → THORChain → ETH, landing at 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. Cross-referenced router OUT memos to match each swap (e.g. 299,998 TRX → 6.01 ETH in tx 0xbd3d97e2…).
Same ETH address receives BTC swaps from bc1qxtl05… since Oct 23, pre-Binance breach. That BTC wallet traces back to a wallet created 2 days after Bitget's $388M hack.
Two exchange hacks, one month apart, converging on a single address = single actor. TRM Labs + Chainalysis attribute to North Korea's TraderTraitor group. Attack vector mirrors Bybit: compromised engineer machine → hijacked signing flow → THORChain exit liquidity.
Every hop is verifiable onchain. The routing pattern is now a fingerprint.
Same ETH address receives BTC swaps from bc1qxtl05… since Oct 23, pre-Binance breach. That BTC wallet traces back to a wallet created 2 days after Bitget's $388M hack.
Two exchange hacks, one month apart, converging on a single address = single actor. TRM Labs + Chainalysis attribute to North Korea's TraderTraitor group. Attack vector mirrors Bybit: compromised engineer machine → hijacked signing flow → THORChain exit liquidity.
Every hop is verifiable onchain. The routing pattern is now a fingerprint.