On-chain investigator ZachXBT has linked the $6.3 billion Binance exploit and the $388 million Bitget exploit after stolen funds from both crypto exchanges converged at the same Ethereum address. The funds arrived through THORChain before being commingled at 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. The shared destination suggests the same actor may be behind both attacks, but it does not by itself prove common authorship.
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked… pic.twitter.com/KH72rXfNkM
— ZachXBT (@zachxbt) October 30, 2026
ZachXBT said the earlier Bitget exploit had been attributed to TraderTraitor, an actor linked to North Korea, and noted overlap with previous incidents including Kelp DAO. The finding adds a new on-chain connection between the two exchange breaches. Tracking flows across bridges and shared addresses can strengthen attribution, although wallet convergence alone remains circumstantial evidence rather than definitive identification of an attacker.
The main issue to watch is whether additional blockchain evidence or independent security assessments reinforce the link between the incidents. Further tracing could clarify how the funds were routed, whether infrastructure was reused and whether the same laundering network handled both thefts. Until then, ZachXBT’s finding supports a likely connection, not a confirmed attribution of the Binance exploit.
Source: ZachXBT.
Disclaimer: Crypto Economy Flash News are based on verified public and official sources. Their purpose is to provide fast, factual updates about relevant events in the crypto and blockchain ecosystem.
This information does not constitute financial advice or investment recommendation. Readers are encouraged to verify all details through official project channels before making any related decisions.
