Onchain investigator ZachXBT said funds from the Binance and Bitget exploits converged at the same address after transfers through THORChain. In an October 30 update, he said the overlap indicates the same actor is likely behind both incidents.
He identified the receiving address as 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 and said the commingling occurred roughly 45 minutes before his post. ZachXBT referred to a $6.3 billion Binance exploit and a $388 million Bitget exploit; those figures are attributed to his account here.
This indicates the same actor is likely behind both incidents.
— ZachXBT (@zachxbt) October 30, 2026
ZachXBT said the Bitget attack had been attributed to the North Korea-linked group TraderTraitor. The group is documented in an earlier FBI statement attributing the separate May 2024 DMM Bitcoin theft to North Korean actors. That statement does not concern the Binance incident.
For context, the investigator linked his September Bitget findings, which described Chinese actors laundering proceeds on behalf of alleged North Korean attackers. His latest post adds a reported point of convergence between the two thefts, while the roles of attackers and intermediaries require separate attribution.
CoinScreamer has not independently reconstructed both fund trails or reconciled the full loss totals. The shared-address report supports ZachXBT’s assessment, rather than establishing the identity of individual hackers. Our earlier Ethereum analysis covers the Binance wallet’s delegation and drain sequence, a separate question from who controlled the attack.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
