Do the Binance and Bitget fund trails point to one attacker?

The amount in a case headline is not the amount at an address

The reports refer to a Binance incident measured at approximately $6.3 billion and a Bitget incident measured at approximately $388 million. Those are the incident sizes in their descriptions. The reports do not establish that the entirety of either sum reached the common address, that both amounts arrived together, or that either sum was still there when the articles were published.

Adding those two figures and calling the result a newly discovered wallet balance would create a number the sources do not report. Calling it a new combined theft would also confuse a reported movement of previously affected funds with a fresh incident. The useful question is which transactions connect the two trails, and what the records show about the destination and subsequent transfers.

ChainCatcher prints an abbreviated address. We are not expanding that abbreviation or treating it as a usable destination. A reader checking a transfer needs the complete address on the correct network and the actual transaction identifier. A prefix or suffix alone is insufficient for that check. This article does not identify any customer's deposit as having reached the reported address.

For readers keeping a record of the case, separate an incident estimate from a transfer value and a wallet balance. The first describes the scale of a reported event. The second belongs to a particular transaction. The third depends on a specific address and observation time. The available convergence reports discuss the first and describe a link; they do not supply a verified balance for the third.

A shared destination supports a question about control

Odaily and ChainCatcher describe the convergence as pointing toward a common attacker. That remains an attributed interpretation. The reporting opened for this article does not include the underlying signing records, an investigator's complete transaction graph, or an exchange statement identifying the person or group in control of the receiving address.

The analytical distinction is between seeing a connection in a money trail and identifying who carried out the original intrusion. A common destination would be relevant to the first question. To answer the second, investigators would need evidence that ties control of the destination and the relevant transfers to the intrusions. We cannot supply that missing link from the two short reports alone.

The distinction also limits what the THORChain reference tells the reader. In these reports, THORChain is part of the described route. Its appearance does not itself establish that THORChain was compromised, that an exchange has resumed withdrawals, or that an ordinary user must take action on that protocol. None of those conclusions follows from the reported convergence.

Both reports repeat a possible attribution involving TraderTraitor and earlier incidents. Because they trace that claim to the same analyst, we do not treat the repetition as independent confirmation of a group or national affiliation. The narrower reportable fact is that the outlets published an analyst-attributed connection between the two fund trails.

The access route is a separate investigation

Reporting on the suspected Binance intrusion addresses a different part of the case. Cointelegraph says Binance's preliminary investigation pointed to a compromised DevOps engineer's laptop, which may have allowed access to a service container and unauthorized withdrawal submissions. The same report says Binance had found no evidence of a wallet private-key leak while its investigation remained ongoing. Read Cointelegraph's account.

PANews also reports the preliminary laptop explanation and the statement about no evidence of private-key leakage. These are reports of Binance's assessment, not a completed forensic finding by NexuAlpha. A reported common destination does not independently prove that access route, and the access explanation does not independently identify the controller of the reported destination. Read PANews' report.

Cointelegraph also describes Blockaid's EIP-7702 analysis as part of the technical discussion. We treat the method as an analyst hypothesis pending a verified technical account. It would be premature to turn that discussion into a claim that every user wallet using the feature is affected, or to tell account holders to sign a transaction to “repair” an exchange wallet.

The reporting cites an estimated $6.3 billion total impact and approximately $3 billion frozen onchain. Those figures describe the wider Binance response in the cited account. They are not measurements of the reported common address. An outflow, a confirmed theft, an asset freeze and a return to a user answer different questions; no one of those labels should silently replace another.

The market board measures positions, not missing assets

NexuAlpha's liquidations board at 14:39 SGT on October 30 showed about $767 million in observed liquidations across Binance and OKX over the preceding 24 hours. Long positions accounted for about $649 million and short positions about $118 million. These figures concern leveraged positions being closed. They do not measure funds taken from a wallet. See the liquidations board.

The same snapshot showed approximately $27.4 million over four hours, split into $5.51 million of longs and $21.9 million of shorts. The one-hour total was about $5.96 million, with approximately $2.98 million on each side. The shorter windows sit inside the longer ones, so adding them would count some positions repeatedly.

The change in the long-short split is useful for readers checking market exposure. The 24-hour window was dominated by long liquidations, while the four-hour window contained more short liquidations. That difference gives a reason to inspect the period before repeating a claim that only one side of the market was under pressure. The board does not establish which news item caused a particular closure.

At the same 14:39 SGT observation, ETH funding was +0.0020% per period on Binance and -0.0076% on OKX. Positive funding means longs pay shorts; negative funding means shorts pay longs. Those signs describe the contracts in that snapshot, without settling any question about the attacker's identity or the status of a withdrawal. See the funding-rate board.

A trader with an open position should inspect the contract's own funding period and margin information. A customer waiting for a transfer should inspect the transfer record. The two tasks can arise at the same time, but the liquidation total cannot substitute for the account's deposit or withdrawal status.

What to check when a transfer is pending

If the pending transfer is on Binance or Bitget, start with the record in the account you already access. Preserve its asset, network, destination, amount and transaction identifier if one is available. Note the displayed status and the time you checked it. If support needs to investigate, a specific transfer record is more useful than a screenshot of an incident headline.

Where the account provides a transaction identifier, compare that record with the relevant network record. Keep the question narrow: whether that transaction appears, what destination it shows, and whether the account has credited or completed it. Do not use the shortened address in a news report to infer that your funds joined the reported route.

For service availability, return to the exchange's own account interface or official channels through your established access path. The sources opened here describe precautions at the time of their reporting. They do not verify the current status of every asset, network or individual account. A new service statement needs its own time and scope before it can answer a pending-transfer question.

Treat unsolicited compensation messages as a separate hazard. Do not connect a wallet or sign a request reached through a stranger's direct message to claim a supposed Binance reimbursement. Do not send a “verification payment” to an address supplied in a reply. Check any compensation claim through the official channels you already use, without following the message's link.

Evidence that would advance this particular story

The most useful next update would provide complete transaction identifiers supporting the claimed convergence, explain the observation time, and identify which parts of the two trails actually met. A later transfer from the destination would be another event to examine, rather than automatic proof of a recovered balance.

An exchange or investigator could also publish an attributed finding about common control. That would need to be read alongside the underlying evidence and the scope of the claim. A finding about who moved funds after an intrusion would still need to be distinguished from a finding about who obtained access in the first place.

For now, the new development is a reported link between the Binance and Bitget trails, carried by two outlets that cite the same analyst. A customer's immediate checks remain the actual transfer record and official service information. Any claimed recovery, new loss or confirmed attacker identification needs evidence beyond the reported convergence.

Quick answers

Have two independent investigations confirmed the shared address?

No. Odaily and ChainCatcher both attribute the observation to ZachXBT. The opened reports do not provide two independent transaction reconstructions.

Is the reported incident total the balance of the shared address?

No. The reports cite the sizes of the incidents without establishing the amount that reached or remained at the reported destination.

Do liquidation totals show how much was stolen?

No. NexuAlpha's liquidation board measures observed forced closures of leveraged positions on Binance and OKX, not assets removed from wallets.