Binance hack: this morning's two new exits both end in bitcoin.
ETH. Parked ETH was swapped to USDC on CoW and bridged with Relay into three Lighter accounts, $219,846 between 06:53 and 07:10 UTC. About a minute later each amount was bridged straight back out with Relay to a fresh Ethereum address, swapped back to ETH and sent through Chainflip to bitcoin. That made 2.81 BTC on bc1qdrj6cs5gdq7dmuem56ptlqznmcs26rgtcj2qcv. The same address has received 6.29 BTC from the attacker's Chainflip swaps since Oct 31, holds 9.11 BTC and has never spent.
NEAR. Through NEAR Intents the attacker has swapped NEAR for 1.63 BTC and 2.12 ETH so far. At 08:09 UTC the BTC moved to two fresh addresses: 1.111 BTC to bc1qvqgswmfsl0a6asl4dq4zw5lfcqyenndx9tp98d and 0.514 BTC to bc1q2sw830snny4x632nnrmm9ncsyppr7vtl9f9xkp.
We track all of these addresses.
ETH. Parked ETH was swapped to USDC on CoW and bridged with Relay into three Lighter accounts, $219,846 between 06:53 and 07:10 UTC. About a minute later each amount was bridged straight back out with Relay to a fresh Ethereum address, swapped back to ETH and sent through Chainflip to bitcoin. That made 2.81 BTC on bc1qdrj6cs5gdq7dmuem56ptlqznmcs26rgtcj2qcv. The same address has received 6.29 BTC from the attacker's Chainflip swaps since Oct 31, holds 9.11 BTC and has never spent.
NEAR. Through NEAR Intents the attacker has swapped NEAR for 1.63 BTC and 2.12 ETH so far. At 08:09 UTC the BTC moved to two fresh addresses: 1.111 BTC to bc1qvqgswmfsl0a6asl4dq4zw5lfcqyenndx9tp98d and 0.514 BTC to bc1q2sw830snny4x632nnrmm9ncsyppr7vtl9f9xkp.
We track all of these addresses.
