ZachXBT said funds stolen in the Binance and Bitget attacks converged at the same address, and assessed that the same actor was likely behind both incidents.
According to a post shared by Wu Blockchain, the researcher found that funds from the $6.3 billion Binance attack and the $388 million Bitget attack reached the same address through THORChain and were mixed there.
These amounts refer to the size of the two attacks; it has not been stated that all the funds reportedly moved to the shared address equal these amounts. ZachXBT interpreted the shared address trail as evidence supporting the possibility of the same attacker.
Phemex connection also emerges in TRX transfers
In a separate investigation, MistTrack reported that TRX stolen in the Binance incident was transferred through the Bitget Wallet Swap Bridge to an address beginning with 0xCd68. According to the reported on-chain analysis, this address had also previously been used by the Phemex attacker.
Two separate findings about the movement of funds have therefore emerged: ZachXBT’s identification of a shared address between Binance and Bitget, and MistTrack’s finding of a Phemex history in the TRX flow.
A new connection to North Korea suspicions
The Bitget attack had previously been attributed to the North Korea-linked TraderTraitor group. The group has also been linked to other attacks, such as the one on Kelp DAO. We covered suspicions that Lazarus and TraderTraitor were behind the Binance attack in our previous report.
ZachXBT’s latest assessment is based not on similarities in methods, but rather on funds from the two attacks reaching a shared address. Although the researcher considers the possibility of the same actor to be strong, the assessment is not presented as a definitive identification.
Not investment advice.