入门 Binance and Bitget theft funds traced to same address via THORChain
Quick answer
On-chain investigator ZachXBT observed that stolen funds from the October 2026 Binance and Bitget incidents flowed through THORChain into a single receiving address. This convergence suggests operational overlap — not proof of identical actors, but consistent infrastructure use across both breaches. No attribution to individuals or groups is claimed. The observation was published on wublock123.com on 2026-10-30.
What did ZachXBT observe?
ZachXBT reported that funds stolen from Binance and Bitget — two separate exchange compromises in October 2026 — were routed via THORChain’s cross-chain swap mechanism into a common Ethereum address. The report does not specify dollar amounts, asset types, or block heights. It notes only that transaction paths converged at one destination. THORChain’s architecture allows swaps between chains without centralized custody, meaning the same address could receive assets originally on BSC (Binance Smart Chain) and Arbitrum (used by Bitget for some withdrawals), depending on how the attacker structured swaps. The source provides no timeline for when the funds arrived at the address, nor how long they remained there.
How does this affect market participants?
Exchanges face renewed scrutiny over cross-chain withdrawal monitoring. Binance and Bitget operate distinct custody models and withdrawal gateways; their parallel exploitation via THORChain highlights gaps in real-time anomaly detection for multi-hop cross-chain transfers. For users, this does not change wallet safety protocols — private key control remains foundational. For liquidity providers on THORChain, the incident underscores that routing infrastructure can be weaponized without compromising the protocol itself. Regulators in jurisdictions tracking virtual asset service providers (VASPs) may revisit Travel Rule implementation timelines, particularly for non-custodial bridges where counterparty KYC is absent. No regulatory action or enforcement notice tied to this observation has been issued as of 2026-10-30.
What remains uncertain?
The source contains no chain analysis confirming whether the same private key signed transactions initiating both thefts. It does not state whether the overlapping address was used for laundering, consolidation, or further distribution. There is no data on whether funds were moved off-exchange before or after THORChain routing, nor whether any portion was frozen or recovered. The report offers no forensic timeline linking the Binance and Bitget incidents chronologically — only post-hoc on-chain convergence. THORChain’s open-source code and public transaction logs are verifiable, but the source does not cite specific block explorers, transaction hashes, or wallet labels used in its analysis.
Frequently asked questions
Q: Does this mean Binance and Bitget were hacked by the same person? A: No. ZachXBT’s observation identifies shared infrastructure — specifically, a common on-chain destination reached via THORChain — not shared identity. Attribution requires signature analysis, behavioral forensics, or intelligence beyond on-chain flow mapping.
Q: Is THORChain compromised or unsafe to use? A: No evidence suggests THORChain’s protocol or nodes were breached. The observation reflects how attackers repurpose intended functionality — cross-chain swaps — to obscure fund origins. This is a known risk for permissionless bridges, documented in prior cryptodlhub glossary entries on cross-chain security.
Risk warning and disclosure
This article reports on-chain observations published by third parties. It does not constitute financial advice, security assessment, or endorsement of any platform. Cryptocurrency transactions are irreversible. Always verify contract addresses and network selections manually before sending assets. Binance’s official domain is binance.com. This page contains an affiliate link to /go/binance-download/ — cryptodlhub receives compensation if readers download the app via that route. We do not guarantee accuracy of external sources, including wublock123.com. Data cited here reflects only what was publicly stated in that report on 2026-10-30.
Risk warning and disclosure
This article is independent third-party information, not an official publication, and is not investment advice.
Related News
入门 Kanye West-linked wallet sells 1,390 ETH to avoid liquidation amid $317K loss
A wallet associated with Kanye West sold 1,390 ETH before October 30, 2026, to reduce loan-to-value pressure and prevent margin liquidation — realizing a…
入门 Binance hacker moves $38.82M ETH to new wallet while holding $1.12B
A hacker linked to Binance’s 2022 hot wallet breach transferred 11,247 ETH ($38.82M) to a never-used wallet. They still hold $1.12B in ETH across 14 walle…
入门 Pando Rings Hackers Buy 7,548 ETH Amid Broader Liquidity Shifts
Hackers linked to the 2025 Pando Rings bridge exploit acquired 7,548 ETH—worth ~$16.72 million—at market rates on October 30, 2026. This move signals stra…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.