Binance hack: a detour through BNB Chain, and where today's Symbiosis flow comes from.
On Oct 31 and Nov 1 the attacker's Tron wallets put $735K of USDT into Bitget Wallet's cross-chain swap in 45 orders. Bitget paid them out on BNB Chain as 1,040 BNB to 40 addresses, each about two minutes after the deposit. We matched them by amount and time, the only way to do it from outside.
Those addresses swapped the BNB back to ETH through the same Bitget swap and sent it on to one wallet, 0xe1f0e5cefa658a58b4f65a37e0ba74e83eaa63df, which received 478.5 ETH in all from those 40 addresses.
We had left that wallet out as unproven. Today it is feeding the Symbiosis bridge on the way to Bitcoin, and has 28 ETH left.
Bitget also sent 8 other orders, $72.6K, straight back to the attacker's Tron wallets within seconds.
On Oct 31 and Nov 1 the attacker's Tron wallets put $735K of USDT into Bitget Wallet's cross-chain swap in 45 orders. Bitget paid them out on BNB Chain as 1,040 BNB to 40 addresses, each about two minutes after the deposit. We matched them by amount and time, the only way to do it from outside.
Those addresses swapped the BNB back to ETH through the same Bitget swap and sent it on to one wallet, 0xe1f0e5cefa658a58b4f65a37e0ba74e83eaa63df, which received 478.5 ETH in all from those 40 addresses.
We had left that wallet out as unproven. Today it is feeding the Symbiosis bridge on the way to Bitcoin, and has 28 ETH left.
Bitget also sent 8 other orders, $72.6K, straight back to the attacker's Tron wallets within seconds.
