Binance and Bitget exploit proceeds converge at single wallet, researcher says
Security & Exploits ·
On-chain investigator ZachXBT reported that funds from the $6.3B Binance exploit and the $388M Bitget exploit were found commingled at the same address, suggesting a shared actor behind both incidents.
According to a post on X, the two pools of stolen funds merged at address 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 roughly 45 minutes before the report, after arriving via THORChain. The overlap is being read as evidence that the Bitget exploit, already attributed to the DPRK-linked group TraderTraitor, and the much larger Binance incident were carried out by the same network. TraderTraitor has previously been tied to other exploits, including the Kelp DAO incident, which adds to a pattern of recurring infrastructure and laundering behavior across separate attacks.
A quoted post dated September 28, 2026 adds detail on how the $388M (cited there as $387M) Bitget proceeds are being moved. Chinese illicit actors allegedly laundering funds on behalf of the DPRK-linked attackers have been openly soliciting order support in public Discord servers and Telegram channels tied to the services they rely on. Several aliases were named in connection with specific transactions, including one, "lolo Marin," also linked earlier this year to laundering from the $292M Kelp DAO exploit. The described laundering method involves chain-hopping funds across bridges before depositing them into mixing services such as Wasabi.
The recurrence of the same alias across multiple incidents, paired with the direct merging of Binance- and Bitget-linked funds at one address, points to a consistent operational structure rather than isolated, unrelated thefts. ZachXBT said this pattern has now been observed after multiple TraderTraitor-attributed exploits and indicated plans to release more data on these laundering groups in coming weeks.
What remains unconfirmed is the full scope of funds routed through the merged address, whether exchanges or bridge operators have taken action against the identified aliases and Discord or Telegram accounts, and how much of the $6.3B and $388M totals have reached mixing services versus funds still in transit. Further disclosures from ZachXBT are expected to clarify the extent of the overlap between the two exploits.