Binance hack funds linked to Phemex hacker addresses.
--
SlowMist's Cosine Monitoring revealed that the Binance hacker's funds are linked to wallet addresses associated with the hackers involved in the Phemex theft in early 2025, an incident involving North Korean hackers.
Reserve stated that the 3.38 billion RSRs stolen from the Binance hot wallet have been sold, the protocol contract is unaffected, and RSR holders do not need to take any action. The attackers exchanged the stolen 3.38 billion RSRs for 1,856 ETH on Uniswap v3, worth approximately $4.1 million.
The hacker split the Bitcoin into 19 wallet addresses, with 17 addresses each receiving 1,000 BTC, one address receiving 832.5 BTC, and another address receiving 437.7 BTC. The 19 wallets still hold the full balance.
The Binance hacker address transferred approximately 17,260 ETH (about $38.82 million) to a new wallet 0x03b....020ea, intending to launder the money through mixers such as Tornado Cash; the attacker still holds approximately 480,720 ETH (about $1.08 billion) that cannot be frozen.
ZachXBT points out that the North Korean hacking group TraderTraitor may have orchestrated the $388 million Bitget attack and the $6.3 billion Binance attack, with the stolen funds from both incidents flowing to the same address.
