Shortly after Binance put the impact of its security incident at $6.3B, on-chain investigator ZachXBT traced part of the stolen funds to an address that also holds Bitget exploit proceeds. Both flows arrived via THORChain before being commingled at 0x15104a9c...feb7.

Pooling proceeds from two separate incidents in a single wallet indicates the same actor is likely behind both the Binance breach and the $388M Bitget exploit.

The Bitget exploit was attributed to DPRK-linked TraderTraitor, a group whose activity also overlaps with earlier incidents such as the $292M Kelp DAO exploit.

Binance has said roughly $3B of affected assets are frozen with partners and pledged to cover all user losses. A confirmed link would tie the largest crypto heist on record to the same DPRK-linked group.