A new lead this afternoon has linked two cases: on-chain investigator ZachXBT detected that approximately $6.3 billion in funds stolen from Binance and approximately $388 million stolen from Bitget were transferred via THORChain and ended up at the same address, 0x151...eb7. He believes both incidents may have been carried out by the same attacker.
Why this convergence point matters: the Bitget incident had previously been linked to TraderTraitor, which is associated with North Korea, and TRM Labs also assessed with high confidence that the Binance case had the same connection. The two trails meet here. One caveat: the use of the same mixing address is a strong lead, not proof of guilt, and the possibility that separate money-laundering networks share a channel cannot be ruled out.
My take is that the focus now is shifting from how much was stolen to whether investigators can use this trail to identify the perpetrator and find a way to recover the funds. If more independent on-chain analytics firms confirm the same convergence point, confidence in the attribution will rise another notch. What do you think exchanges most need to strengthen next: their technical defenses, or controls around internal access?
Why this convergence point matters: the Bitget incident had previously been linked to TraderTraitor, which is associated with North Korea, and TRM Labs also assessed with high confidence that the Binance case had the same connection. The two trails meet here. One caveat: the use of the same mixing address is a strong lead, not proof of guilt, and the possibility that separate money-laundering networks share a channel cannot be ruled out.
My take is that the focus now is shifting from how much was stolen to whether investigators can use this trail to identify the perpetrator and find a way to recover the funds. If more independent on-chain analytics firms confirm the same convergence point, confidence in the attribution will rise another notch. What do you think exchanges most need to strengthen next: their technical defenses, or controls around internal access?