A cryptocurrency wallet associated with a past Binance security breach witnessed the transfer of approximately $38.82 million worth of Ethereum (17,260 ETH) to a new address, raising suspicions about potentially connected hacks. On-chain analysis platforms tracked the movements of these funds, while researcher ZachXBT suggested that this address consolidation from both Binance and Bitget suggests a single culprit or group behind the attacks.
Binance and Bitget Heists Linked
ZachXBT highlighted the intermingling of stolen funds: $6.3 billion from Binance and $388 million from Bitget. These assets, following their route through THORChain, converged at a single wallet, hinting at a common orchestrator between the incidents. Bitget’s breach had previously been linked to the infamous TraiderTraitor group, believed to have North Korean affiliations and connections to other cyber heists like Kelp DAO.
Arkham, a prominent watchdog in blockchain forensics, reported uncovering this substantial ETH movement tied to addresses labeled as “Binance Hacker.” However, it remains uncertain if these funds will flow into anonymous mixers like Tornado Cash, known for obscuring transaction trails.
Analyzing the Tornado Cash Concern
OnchainLens, another blockchain tracking service, confirmed the ETH’s relocation to a fresh wallet, suggesting the funds could be laundered via Tornado Cash or similar services. The accuracy of these claims is yet to be verified, as there is no concrete evidence that the assets have been transferred to such mixer protocols. Post-transfer assessments reveal discrepancies in the residual holdings of the perpetrator, with Arkham estimating an ETH reserve of approximately $1.12 billion, while OnchainLens places it at $1.08 billion or 480,720 ETH.
In an unfolding narrative concerning other stolen assets, Reserve announced that approximately 3.38 billion RSR, compromised during the Binance breach, was liquidated via Uniswap v3 in exchange for around 1,856 ETH, valued at $4.1 million. They assured that their protocol’s smart contracts remain secure and RSR holders need not take action.
Similarly, 1inch disclosed that its native tokens were also compromised. The organization swiftly coordinated with partners such as ZeroShadow and SEAL 911, among others, to block the implicated addresses across their platforms. A
“We have engaged with Binance to provide support and have already blacklisted related addresses in our dApp, Wallet, and API within an hour,”
a team statement revealed.
While these efforts include updating blacklist databases with new suspicious addresses and informing partners, the ERC-20 tokens’ technical guidelines prevent outright freezing, meaning illicitly acquired tokens cannot be sidelined. The 1inch team expressed commitment to collaborate with Binance and law enforcement in asset recovery efforts.
