Pinned Tweet
Funds are SAFU. The loot is not.
Here is why North Korea cannot repeat the Bybit escape.
THE BYBIT PLAYBOOK, FEB 2025
The same group stole ~400K+ ETH from Bybit and washed it fast:
• Day 5: ~145K ETH laundered, about 30% (SpotOnChain)
• Day 7: 270K ETH gone, over half (Lookonchain)
• Done in about 10 days
The exits: THORChain for ETH to BTC, eXch, and the OKX Web3 DEX aggregator.
WHAT HAPPENED TO THOSE EXITS
• eXch: shut down in April 2025, citing a DOJ whistleblower and an active transatlantic operation.
• OKX: paused its DEX aggregator, then relaunched it with real time abuse detection and blocking.
• THORChain: this time the FBI is pressing its node operators directly, and swaps went dark.
• The FBI itself: Bybit's address list came out 5 days after the hack. This time, 600+ addresses flagged within days.
PROOF, ONCHAIN, 2 NOV
Bybit's hacker had washed ~30% of the ETH by day 5.
Binance's hacker, day 4:
522,409 ETH parked in 8 wallets. Transactions sent: 0.
18,270 BTC. Satoshis moved: 0.
$161M in wBETH, XAUt, USD1, PAXG. Touched: 0.
Laundered from the big pile: 0%.
The playbook that worked in 2025 has been burned. Every door they used then has a guard on it now. So they scrape crumbs on Tron and Solana, while $2.8B sits in plain sight, watched by everyone.
On the other side, Binance reopened withdrawals, paid out $3.64B in net outflows, and says 95% of the impact is already covered.
The users are whole. The thieves are stuck.
Funds are SAFU. The loot is not. 🔶
We followed the Binance attacker's Tron money. It leads to the same wallet as the Bitget hack.
THE PATH (every hop onchain)
• 20:21 UTC, 29 Oct: Binance Hot 7 on Tron sends 612.7M USDT and 46.4M TRX to TG5iBMQ…
• 00:06 UTC: 46.38M TRX moves on to TRBdWq…
• From there to TDNF7…, directly and through a pooling wallet
• TDNF7 swaps TRX and USDT through THORChain into ETH, paid out to:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
We matched each payout to its Tron source by the router's OUT memo. Example: 299,998 TRX in, 6.01 ETH out (0xbd3d97e2…).
THE SAME WALLET'S OTHER FEEDER
A Bitcoin wallet, bc1qxtl05…, swaps BTC into ETH for the same address through THORChain. It was active since 23 Oct, before the Binance theft. Its funds trace back to a wallet that appeared two days after the $388M Bitget breach.
WHAT IT MEANS
Two exchange hacks, one month apart, settling into one address. That points to one actor.
We traced the Binance side hop by hop and it holds.
Analysts at TRM Labs and Chainalysis name North Korea's TraderTraitor. Same playbook as Bybit: a compromised engineer machine, a hijacked signing flow, THORChain for the exit.
Every hop is public. Every hop is watched.
Could the Binance attacker crash ETH and BTC? We pulled the data.
WHAT IT HOLDS (onchain, 30 Oct 12:10 UTC)
• 511,854 ETH (~$1.15B) in 8 wallets. None has sent a single transaction.
• 18,270 BTC (~$1.42B) in 19 fresh addresses. Untouched.
WHAT THE MARKET CAN TAKE
Every bid within 10% of price across Binance, Coinbase, OKX, Bybit, Kraken and Bitstamp:
• ETH: ~34K ETH. The stash is 15x that.
• BTC: ~2.6K BTC. The stash is 7x that.
It cannot touch those books anyway. Every exchange has flagged these addresses. So its only doors are onchain:
• DEX aggregators, live quotes: 20K ETH sold at once costs ~4.5%. 100K ETH costs ~38%.
• THORChain's entire ETH pool: 1,928 ETH. The stash is 265x bigger.
PRECEDENT
Bybit, Feb 2025: Lazarus moved ~400K+ ETH out in about 10 days. ETH/BTC fell ~10%, during a market wide selloff.
Germany, 2024: 50K BTC sold over 3 weeks. BTC dipped 11%, then recovered 12% in 3 days once selling stopped.
Mark this post. SAFU is about to get bigger.
Look at the pattern👇
2018: Binance creates SAFU from 10% of trading fees. Nobody asked for it.
2019: 7,000 BTC stolen. SAFU pays. Users lose nothing.
2026: SAFU moves into 15,000 BTC, with a floor Binance commits to top up.
Every test made it stronger. This one will too.
Last night was the biggest attack in crypto history. About $6.3B hit, about $3B frozen within hours, users covered by SAFU and Binance's own funds.
Hacks test exchanges. Some break. Binance builds a bigger shield.
Bigger SAFU fund is coming. 🔶 U will see 📝
Binance's preliminary finding,a compromised DevOps laptop gave the attacker access to a service container, which pushed unauthorized withdrawals. No private key leaked.
Here is what the chain showed at 20:24 UTC, hours earlier👇
• Binance 16 signed nine transfers to the attacker inside its normal withdrawal flow. Same key, but different software: a 2.4 gwei tip instead of the bot's 1.0, and custom gas limits instead of its fixed 207,128.
• On Bitcoin, 18,270 BTC left at 10 sat/vB. Binance's normal payouts that hour paid 5.
Real signatures. Wrong software. That is what a hijacked signing pipeline looks like.
Response👇
• 00:10:35 UTC: Binance revoked the EIP 7702 delegation on Binance 14. The door is closed.
• Since then, Binance 14 has been moving what is left to Binance 8.
• About $3B frozen with partners.
Attacker now 👇
• 511,854 ETH in 8 wallets. Not one of them has sent a single transaction.
• 18,270 BTC, untouched.
• Every wallet is mapped and watched.
User funds, covered. SAFU. 🔶
Who funded the Binance exploiter? We traced every wallet back.
All roads end at Tornado Cash, six withdrawals, 1.5 ETH total, 28 to 29 Oct.
No CEX touchpoint.
One exception, the exploiter bridged via MetaMask Bridge → Bridgers to Arbitrum. Order hakpi6.
Binance exploiter is now bridging stolen AVAX through Circle's own CCTP.
22:16 UTC: 200,000 AVAX → 1,563,832 USDC on Avalanche
22:17: burned via CCTP, to be minted on Ethereum to 0xc39e…9824
Circle already froze $823M from this attacker. @circle
Ethereum is the getaway car of every major hack.
Tonight's Binance attacker raced Tether's freeze: 100M USDT swapped into ETH in five minutes. The 30M that didn't make it is frozen.
Every step of the attack ran on an Ethereum feature.
FUNDED by Tornado Cash, on Ethereum. Six withdrawals, 1.5 ETH, origin erased.
ENTERED through EIP 7702, first authored by Vitalik. One signature, and Binance 14 has stayed under the attacker's control for 3 hours, swept 4 times.
ESCAPED into ETH. Watch what they did with everything else:
• USDT, USDC, RLUSD: frozen within the hour, $2.2B locked
• UNI, AAVE, WBTC, ONDO: sold 100% into ETH
• LINK, PEPE, ENA, USDe: being sold into ETH right now, every 12 seconds
Result: about 420,000 ETH, $950M, in five wallets. Nobody on Earth can freeze it.
THIS IS NOT NEW
• KuCoin, 2020: stolen tokens dumped on Uniswap straight into ETH, racing the token freezes.
• Ronin, 2022: 173,600 ETH stolen, washed through Tornado Cash on Ethereum.
• WazirX, 2024: SHIB, PEPE and MATIC converted into ETH within hours. Analysts said why: ETH has no blacklist function.
• Bybit, 2025: about 400,000 ETH stolen, moved out through THORChain within days.
Different exchanges. Same exit. ETH.
AND VITALIK?
In 2016, when The DAO hack hit Ethereum insiders, his first answer was a soft fork to blacklist the attacker. Then Ethereum rewound its own history to give the money back.
When it is someone else's money, ETH is unstoppable.
Stablecoin issuers acted in minutes. Ripple froze its token in the same block as the attacker's last sale.
The only asset no one could touch was ETH.
Crypto keeps building brakes. Ethereum keeps being the getaway car.
We traced the Binance hot wallet drain transaction by transaction. Here is what the chain shows.
SETUP
28 Oct 07:39 UTC: a fresh wallet, 0x7c86…5ca0, receives its first gas from Tornado Cash. Three 0.1 ETH withdrawals over two days.
29 Oct 15:59: it deploys a small contract, 0x63e8…6fae. The bytecode hardcodes 0x7c86 as the only operator.
Afternoon: test transactions to throwaway addresses.
KEY MOMENT
20:20:59: 0x7c86 sends one EIP 7702 transaction to Binance 14, Binance's largest Ethereum hot wallet.
Inside: 50 authorizations, all signed with Binance 14's own key, for 50 consecutive nonces (18914775 to 18914824). Spraying nonces guarantees one lands on a wallet that sends thousands of txs a day.
Result: Binance 14 now runs the attacker's code.
Tx: 0xad99264d…298b
SWEEP
20:24:23: a single call drains Binance 14 into a new address, 0x5227…2f8c:
• 167,464 ETH
• 1,615,409,499 USDT
• 7.17T PEPE, 2.26M LINK, 82.5 WBTC
• 60 more tokens
Tx: 0x53bd38b8…e2f3
20:24:47: Binance 16 sends 28,005.6 ETH and 55.7M USDT to the same address. These were signed by Binance 16's own key.
20:41 and 20:59: 780M and 43M USDC pulled from a Binance controlled contract.
21:04: a second sweep takes fresh deposits, including 1,699.9 ETH.
WHERE IT WENT
20:29: two test sends of 0.5 ETH. Then:
• 500M USDT to 0x9749…c762, swapped through Uniswap into 122,313 ETH
• 200M USDT to 0x0ddf…697e, then 190M on to 0x8d53…639a
• 195,460 ETH to 0x8532…43d4, untouched so far
THE RESPONSE
21:05: Tether freezes about $971M USDT.
Circle freezes about $823M USDC.
21:16: Binance says it is investigating.
Etherscan tags 0x7c86 and 0x5227 as "Binance Hot Wallet Exploiter".
WHAT IT TELLS US
Not an approval bug, not a smart contract hack. Two hot wallets produced valid signatures for an attacker: Binance 14 signed the 7702 delegation, and Binance 16 signed the transfers. Something in the signing path was compromised. How is not public.
No exchange deposits, no bridges and no Tornado deposits yet.
Receipts, all on Etherscan:
1. EIP 7702 delegation on Binance 14, 50 signed authorizations:
etherscan.io/tx/0xad99264d55…
2. The sweep, 167,464 ETH + 1.6B USDT + 60 tokens in one call:
etherscan.io/tx/0x53bd38b816…
3. Attacker wallet, funded by Tornado Cash:
etherscan.io/address/0x7c860…
4. Collection wallet:
etherscan.io/address/0x5227f…
5. 195,460 ETH, untouched:
etherscan.io/address/0x8532f…
ENA selling has started.
22:51:59 UTC: the Binance exploiter sold 3.8M ENA on Uniswap V3, 36 seconds after approving the full 217.5M.
213.7M ENA (~$39M) still to go from 0x7f9d…15e3. Same pattern that just emptied its UNI and WBTC.
Ripple froze the Binance exploiter's RLUSD.
22:00:59 UTC: seller wallet 0xe702…958d paused, same block as its last sale.
40.5M RLUSD locked. 48M got out before the freeze.
22:20: Ripple also paused RLUSD on Binance 14, still delegated to the attacker.
Fast. 👏
