Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All people and organisations

ZachXBT

People. Onchain investigator

The statements below are attributed to this speaker by the cited sources. Appearing here is not an accusation.

Statements, oldest first

ReportedattributionStatement 783

ZachXBT posted on X that funds stolen from Binance and from the Bitget exploit were commingled at the same address 45 minutes before his post, after arriving via THORChain, which he said indicates the same actor is likely behind both incidents.

Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents.

Speaker
ZachXBT
Publisher
X (Social media)
Original
X post by ZachXBT (@zachxbt), 2026-10-30T04:51:48.000Z: @SpecterAnalyst Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago,
Captured
Stored copy
sha256 8f2b49acb6ef
Event time
ReportedattributionStatement 784

ZachXBT's post says the Bitget exploit was attributed to DPRK-linked; the archived text of the post ends at that word.

The Bitget exploit was attributed to DPRK-linked

Speaker
ZachXBT
Publisher
X (Social media)
Original
X post by ZachXBT (@zachxbt), 2026-10-30T04:51:48.000Z: @SpecterAnalyst Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago,
Captured
Stored copy
sha256 8f2b49acb6ef
Event time
ReportedattributionStatement 128

Cointelegraph reported that onchain investigator ZachXBT said stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain.

In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.

Speaker
ZachXBT
Publisher
Cointelegraph (News media)
Original
As it happened: Binance’s record $6.3B crypto hack
Captured
Stored copy
sha256 c92181b6b4e0
Event time
Published
ReportedattributionStatement 347

Cointelegraph reported that ZachXBT said Binance funds and Bitget funds were commingled in the same address, which he said indicates the same actor is likely behind both incidents.

“This indicates the same actor is likely behind both incidents,” he said.

Speaker
ZachXBT
Publisher
Cointelegraph (News media)
Original
As it happened: Binance’s record $6.3B crypto hack
Captured
Stored copy
sha256 c92181b6b4e0
Event time
Published