Addresses

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

At 20:24:23, three minutes and 24 seconds later, the operator called sweep on Binance 14 (transaction ), sending 167,464 ETH, 1.615B USDT, and about 60 other tokens to a collection address with no prior history, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c . Binance 14 was left with 1 ETH. At prices at the time, the basket was worth about $2.5B.

The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.

Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address , as ZachXBT first reported.

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors: