Funds are SAFU. The loot is not.
Here is why North Korea cannot repeat the Bybit escape.
THE BYBIT PLAYBOOK, FEB 2025
The same group stole ~400K+ ETH from Bybit and washed it fast:
• Day 5: ~145K ETH laundered, about 30% (SpotOnChain)
• Day 7: 270K ETH gone, over half (Lookonchain)
• Done in about 10 days
The exits: THORChain for ETH to BTC, eXch, and the OKX Web3 DEX aggregator.
WHAT HAPPENED TO THOSE EXITS
• eXch: shut down in April 2025, citing a DOJ whistleblower and an active transatlantic operation.
• OKX: paused its DEX aggregator, then relaunched it with real time abuse detection and blocking.
• THORChain: this time the FBI is pressing its node operators directly, and swaps went dark.
• The FBI itself: Bybit's address list came out 5 days after the hack. This time, 600+ addresses flagged within days.
PROOF, ONCHAIN, 2 NOV
Bybit's hacker had washed ~30% of the ETH by day 5.
Binance's hacker, day 4:
522,409 ETH parked in 8 wallets. Transactions sent: 0.
18,270 BTC. Satoshis moved: 0.
$161M in wBETH, XAUt, USD1, PAXG. Touched: 0.
Laundered from the big pile: 0%.
The playbook that worked in 2025 has been burned. Every door they used then has a guard on it now. So they scrape crumbs on Tron and Solana, while $2.8B sits in plain sight, watched by everyone.
On the other side, Binance reopened withdrawals, paid out $3.64B in net outflows, and says 95% of the impact is already covered.
The users are whole. The thieves are stuck.
Funds are SAFU. The loot is not. 🔶
We followed the Binance attacker's Tron money. It leads to the same wallet as the Bitget hack.
THE PATH (every hop onchain)
• 20:21 UTC, 29 Oct: Binance Hot 7 on Tron sends 612.7M USDT and 46.4M TRX to TG5iBMQ…
• 00:06 UTC: 46.38M TRX moves on to TRBdWq…
• From there to TDNF7…, directly and through a pooling wallet
• TDNF7 swaps TRX and USDT through THORChain into ETH, paid out to:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
We matched each payout to its Tron source by the router's OUT memo. Example: 299,998 TRX in, 6.01 ETH out (0xbd3d97e2…).
THE SAME WALLET'S OTHER FEEDER
A Bitcoin wallet, bc1qxtl05…, swaps BTC into ETH for the same address through THORChain. It was active since 23 Oct, before the Binance theft. Its funds trace back to a wallet that appeared two days after the $388M Bitget breach.
WHAT IT MEANS
Two exchange hacks, one month apart, settling into one address. That points to one actor.
We traced the Binance side hop by hop and it holds.
Analysts at TRM Labs and Chainalysis name North Korea's TraderTraitor. Same playbook as Bybit: a compromised engineer machine, a hijacked signing flow, THORChain for the exit.
Every hop is public. Every hop is watched.
Could the Binance attacker crash ETH and BTC? We pulled the data.
WHAT IT HOLDS (onchain, 30 Oct 12:10 UTC)
• 511,854 ETH (~$1.15B) in 8 wallets. None has sent a single transaction.
• 18,270 BTC (~$1.42B) in 19 fresh addresses. Untouched.
WHAT THE MARKET CAN TAKE
Every bid within 10% of price across Binance, Coinbase, OKX, Bybit, Kraken and Bitstamp:
• ETH: ~34K ETH. The stash is 15x that.
• BTC: ~2.6K BTC. The stash is 7x that.
It cannot touch those books anyway. Every exchange has flagged these addresses. So its only doors are onchain:
• DEX aggregators, live quotes: 20K ETH sold at once costs ~4.5%. 100K ETH costs ~38%.
• THORChain's entire ETH pool: 1,928 ETH. The stash is 265x bigger.
PRECEDENT
Bybit, Feb 2025: Lazarus moved ~400K+ ETH out in about 10 days. ETH/BTC fell ~10%, during a market wide selloff.
Germany, 2024: 50K BTC sold over 3 weeks. BTC dipped 11%, then recovered 12% in 3 days once selling stopped.
Mark this post. SAFU is about to get bigger.
Look at the pattern👇
2018: Binance creates SAFU from 10% of trading fees. Nobody asked for it.
2019: 7,000 BTC stolen. SAFU pays. Users lose nothing.
2026: SAFU moves into 15,000 BTC, with a floor Binance commits to top up.
Every test made it stronger. This one will too.
Last night was the biggest attack in crypto history. About $6.3B hit, about $3B frozen within hours, users covered by SAFU and Binance's own funds.
Hacks test exchanges. Some break. Binance builds a bigger shield.
Bigger SAFU fund is coming. 🔶 U will see 📝
Binance's preliminary finding,a compromised DevOps laptop gave the attacker access to a service container, which pushed unauthorized withdrawals. No private key leaked.
Here is what the chain showed at 20:24 UTC, hours earlier👇
• Binance 16 signed nine transfers to the attacker inside its normal withdrawal flow. Same key, but different software: a 2.4 gwei tip instead of the bot's 1.0, and custom gas limits instead of its fixed 207,128.
• On Bitcoin, 18,270 BTC left at 10 sat/vB. Binance's normal payouts that hour paid 5.
Real signatures. Wrong software. That is what a hijacked signing pipeline looks like.
Response👇
• 00:10:35 UTC: Binance revoked the EIP 7702 delegation on Binance 14. The door is closed.
• Since then, Binance 14 has been moving what is left to Binance 8.
• About $3B frozen with partners.
Attacker now 👇
• 511,854 ETH in 8 wallets. Not one of them has sent a single transaction.
• 18,270 BTC, untouched.
• Every wallet is mapped and watched.
User funds, covered. SAFU. 🔶
Plot twist on the Binance hack, scammers are now trying to rob the hacker.
04:35 UTC, fake transfers "from" the exploiter's wallets, copying its real amounts (41,397.81 and 3,552) to lookalike addresses.
Address poisoning. One bad copy paste and the thief gets robbed.
Ethereum is the getaway car of every major hack.
Tonight's Binance attacker raced Tether's freeze: 100M USDT swapped into ETH in five minutes. The 30M that didn't make it is frozen.
Every step of the attack ran on an Ethereum feature.
FUNDED by Tornado Cash, on Ethereum. Six withdrawals, 1.5 ETH, origin erased.
ENTERED through EIP 7702, first authored by Vitalik. One signature, and Binance 14 has stayed under the attacker's control for 3 hours, swept 4 times.
ESCAPED into ETH. Watch what they did with everything else:
• USDT, USDC, RLUSD: frozen within the hour, $2.2B locked
• UNI, AAVE, WBTC, ONDO: sold 100% into ETH
• LINK, PEPE, ENA, USDe: being sold into ETH right now, every 12 seconds
Result: about 420,000 ETH, $950M, in five wallets. Nobody on Earth can freeze it.
THIS IS NOT NEW
• KuCoin, 2020: stolen tokens dumped on Uniswap straight into ETH, racing the token freezes.
• Ronin, 2022: 173,600 ETH stolen, washed through Tornado Cash on Ethereum.
• WazirX, 2024: SHIB, PEPE and MATIC converted into ETH within hours. Analysts said why: ETH has no blacklist function.
• Bybit, 2025: about 400,000 ETH stolen, moved out through THORChain within days.
Different exchanges. Same exit. ETH.
AND VITALIK?
In 2016, when The DAO hack hit Ethereum insiders, his first answer was a soft fork to blacklist the attacker. Then Ethereum rewound its own history to give the money back.
When it is someone else's money, ETH is unstoppable.
Stablecoin issuers acted in minutes. Ripple froze its token in the same block as the attacker's last sale.
The only asset no one could touch was ETH.
Crypto keeps building brakes. Ethereum keeps being the getaway car.
Binance exploiter, 23:02 UTC. Dumping 5 tokens at once, every block:
UNI, AAVE, WBTC: 100% sold
LINK: 59%
PEPE: 35%
ONDO, ENA, USDe: just started
Meanwhile $2.2B in USDT, USDC and RLUSD sits frozen.
ENA selling has started.
22:51:59 UTC: the Binance exploiter sold 3.8M ENA on Uniswap V3, 36 seconds after approving the full 217.5M.
213.7M ENA (~$39M) still to go from 0x7f9d…15e3. Same pattern that just emptied its UNI and WBTC.
@binance Binance 14 just got swept a 4th time.
22:39 UTC: 128.5 ETH + ~120 tokens moved to a fresh wallet 0xa97b…8d10.
The hot wallet is still delegated to the attacker's contract via EIP 7702. Every deposit that lands there gets taken.
Revoke the delegation.🙏🙏🙏🙏🙏🙏
Ripple froze the Binance exploiter's RLUSD.
22:00:59 UTC: seller wallet 0xe702…958d paused, same block as its last sale.
40.5M RLUSD locked. 48M got out before the freeze.
22:20: Ripple also paused RLUSD on Binance 14, still delegated to the attacker.
Fast. 👏
Binance exploiter is now bridging stolen AVAX through Circle's own CCTP.
22:16 UTC: 200,000 AVAX → 1,563,832 USDC on Avalanche
22:17: burned via CCTP, to be minted on Ethereum to 0xc39e…9824
Circle already froze $823M from this attacker. @circle
What the Binance exploiter still holds, from the chain:
Frozen: ~$2.18B (USDT + USDC)
ETH: ~345,500 (~$780M)
Unsold tokens: ~$480M (wBETH, XAUt, ENA, PEPE, UNI, LINK...)
Still freezable: XAUt $50.6M, RLUSD $40.5M, USD1 $27.8M, USDe $9.7M, PAXG $7.7M.
Binance exploiter is now selling PEPE.
22:01 UTC: 68B PEPE dumped on Uniswap V2 from 0x600d…8298. Test size.
7.7 trillion PEPE (~$37M) still in that wallet.
Also selling UNI and RLUSD in growing chunks, and moving AVAX out in 500k blocks.
What the Binance exploiter left behind:
• Custom sweeper code, never seen before
• Funded only via Tornado Cash, 1.5 ETH
• Swaps and bridges through MetaMask, now to Arbitrum and Optimism
Binance exploiter's RLUSD dump is speeding up.
Chunks: 1M → 4M → 10M → 10M
26M sold, now 11,182 ETH in seller wallet 0xe702…958d
62.5M RLUSD still sitting there, freezable.
Ripple this is the last window.
Binance exploiter just moved 122,310 ETH (~$279M) in one shot.
21:47 UTC: 0x9749…c762 → 0xc887…286a, a fresh wallet with no history.
This is the ETH from the 500M USDT swapped via UniswapX. Two 20 ETH test sends came first.
Tether freeze just worked live.
21:40 UTC the Binance exploiter tried to move 8.4M USDt on Avalanche.
Transaction reverted. Address blocked.
Meanwhile on Ethereum they started selling RLUSD, 1M swapped for 435 ETH. 87.5M still freezable.
Who funded the Binance exploiter? We traced every wallet back.
All roads end at Tornado Cash, six withdrawals, 1.5 ETH total, 28 to 29 Oct.
No CEX touchpoint.
One exception, the exploiter bridged via MetaMask Bridge → Bridgers to Arbitrum. Order hakpi6.