ZachXBT Links $6.3B Binance Exploit to $388M Bitget Hack Through Shared Crypto Address
Stolen funds linked to a $6.3 billion Binance exploit and a separate $388 million Bitget exploit have reportedly converged at the same cryptocurrency address, raising suspicions that both incidents may involve the same attacker. Blockchain investigator ZachXBT reported that funds from the two incidents arrived through THORChain and were commingled at a single address.
The finding points to a potential connection between two major cryptocurrency security incidents. However, the shared address and movement of funds do not, on their own, establish the identity of the attacker or conclusively prove that the same individual or group was responsible for both exploits.
ZachXBT Identifies a Potential Link Between the Exploits
According to information shared by Wu Blockchain, ZachXBT said funds associated with the Binance and Bitget incidents were routed through THORChain before being combined at the same address. Based on this overlap, the blockchain investigator indicated that the same actor was likely behind both incidents.
The reported amounts associated with the two exploits are $6.3 billion for Binance and $388 million for Bitget. The alleged connection is based on the movement and commingling of stolen funds, rather than a publicly established identification of the person or group responsible.
The Bitget exploit had previously been attributed to TraiderTraitor, a threat actor linked to North Korea. The reported attribution adds another layer to the investigation, although the shared-address evidence alone does not independently confirm that attribution or establish responsibility for the Binance incident.
MistTrack Traces Binance-Linked TRX Through Bitget Wallet Swap Bridge
Separate on-chain tracking cited by MistTrack provides additional details about the movement of funds associated with the Binance incident. According to MistTrack, stolen TRX from the incident flowed through Bitget Wallet Swap Bridge before reaching a cryptocurrency address beginning with 0xCd68.
The address is significant because on-chain tracking indicates that it had previously been used by the Phemex hacker. This historical connection creates another point of overlap among addresses associated with earlier cryptocurrency thefts, but it does not by itself establish that the same attacker controlled the wallet in every case.
The reported route through Bitget Wallet Swap Bridge and the subsequent arrival of funds at an address with a connection to a previous hack provide investigators with specific transaction paths to examine. The reported use of THORChain and the commingling of funds at a common address form the central basis of the potential link identified by ZachXBT.
Previous Exploits Add Context to the Investigation
The reported attribution of the Bitget incident to the North Korea-linked TraiderTraitor also has connections to other previous exploits. The source material identifies overlap with earlier incidents, including Kelp DAO. These associations provide context for the investigation but should not be treated as definitive proof that all of the incidents involved the same attacker.
The available information identifies several elements for further examination: the movement of funds through THORChain, the shared address receiving funds associated with the Binance and Bitget exploits, the TRX route through Bitget Wallet Swap Bridge, and the address beginning with 0xCd68 that was previously used by the Phemex hacker.
At this stage, the reported findings support a suspected connection markets between the incidents, not a conclusive attribution of both exploits to one actor. The key on-chain detail is that funds linked to the two incidents were reportedly commingled at the same address, while the address beginning with 0xCd68 has a separate historical connection to the Phemex hack.
Writer: Victoria HaleTechnology & Blockchain WriterVictoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.She prioritises clarity and accuracy when explaining technical developments to a general audience.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.