and recovering crypto assets.
and recovery crypto assets.
to cryptocurrency.
to cryptocurrency.
for illicit funds.
for illicit funds.
и связей между кошельками.
и связей между кошельками.
с криптовалютой.
с криптовалютой.
Behind these figures lies a recurring playbook. The hackers gain control of signing authority, either through people or infrastructure, test their route with small amounts, and within minutes convert assets susceptible to freezing into ETH or borrow against them. They then wait two and a half to five days before moving the funds through batches of script-generated transactions.
Freezes were effective only where the attackers had not yet swapped the stablecoins. At Binance, 43% of the stolen funds were frozen or seized; across all the other major attacks combined, the figure was just 6%.
We also uncovered an operational mistake: 5,047 ETH passed through Umbra and Stargate, but tiny residual balances from addresses associated with AFX, the August 28 theft and Bitget all ended up in the same wallet.
Figure 1 — Six major attacks in 2026
Contents:
- Six Major Attacks
- Compromised Signatures, Not Software Vulnerabilities
- How the Hackers Prepare
- Moving the Funds: From the First Minutes to BTC
- Automating the Laundering Process
- What Worked Against the Attackers
- How the Attacks Are Connected
- North Korean IT Workers: A Different Flow of Funds
- Estimating the Losses
- Conclusion
Six Major Attacks
Six Major Attacks
Date (UTC) | Target and entry point | Amount | On-chain evidence |
Apr 1, 16:05 | Drift. Multisig signers pre-signed durable-nonce transactions, after which the attacker took control of administrator privileges | $295.71M | advanceNonce at 16:05:19; 19 assets withdrawn |
Apr 18, 17:35 | KelpDAO. A bridge relying on a single LayerZero verifier accepted a forged message and minted 116,500 rsETH | $293.72M | Transfer from adapter 0x85d456b2dff1fd8245387c0bfb64dfb700e98ef3 |
Jul 22, 21:26 | AFX. Five signatures from seven nearly equally weighted bridge validators authorized the withdrawal of 24,150,000 USDC | $24.15M | Signatures can be recovered from call data |
Aug 28, 10:18 | Wallet 0xa4cca98ea7a48223e135d77d889266c6de22c3ad: transactions signed by the wallet key moved 10.19M USDC and 3.37M USDT, plus $4.43M on TRON | $18.00M | Transfers at 10:18:23 and 10:27:23 |
Sep 24, 18:31 | Bitget. The wallet system received fraudulent withdrawal instructions | $385.29M | Signed transfers across eight networks |
Oct 29, 20:20 | Binance. Entry via a DevOps engineer’s laptop and a service signing container | $6.41B | 58 transactions across 11 networks; 50 Binance 14 authorizations |
Compromised Signatures, Not Software Vulnerabilities
Compromised Signatures, Not Software Vulnerabilities
Many attacks took place overnight in Pyongyang: 1:05 a.m. for Drift, 2:35 a.m. for KelpDAO, 3:31 a.m. for Bitget, 5:20 a.m. for Binance and 6:26 a.m. for AFX. The August 28 theft began at 7:18 p.m. For victims in different time zones, these times often fell at the end of the working day or during the night.
How the Hackers Prepare
How the Hackers Prepare
KelpDAO | Binance | Drift | |
Deposit address | 0x24ea3b6afa51dc28a9f4dc5b719593ca247208ab | 0x756014e45e210fbdd9998822941b3bb17248c1dd | Preparation addresses |
Deposits | 11: 1 × 1 ETH and 10 × 0.1 ETH | 12: 1 × 1 ETH and 11 × 0.1 ETH | 35 totaling 117.8 ETH |
Last deposit before the attack | 10.5 hours | 2.9 hours | 22 days |
Withdrawals to attack-related addresses | 10 totaling 1.87 ETH; last one 3.9 hours before | 6 totaling 1.48 ETH; last one 5.4 hours before | 7 totaling 20.41 ETH; last one 50.6 hours before |
Figure 2 — Gas funding ahead of the Binance attack
Attack | Test transaction | Main operation |
KelpDAO | Apr 16: 0.004 and 0.006 rsETH through the same bridge to 0x222e68aa6658a8067585f19ecca5440feaa8bb00; Apr 17–18: small collateral deposits and loans in Compound (0x08b8bae9962714b79c33ff205cd3501f98a8fda7) and Aave (0x5579d5ce84ff5adf5ec7b466d155735958f6902b) | Apr 18: 53,000 rsETH deposited in Aave 3 min 12 sec after minting |
Drift | Mar 24: 1 SOL sent to the attacker’s address | Apr 1: 19 assets withdrawn |
AFX | CCTP transfer of 100,000 USDC | 5M USDC after 83 sec |
Aug 28 theft | Umbra: 0.4 ETH two days earlier | 209 ETH |
Bitget | 0.84 ETH and 93 TRX | 7,131 ETH after 30 min |
Binance | Contracts tested on the attacker’s own wallets at 13:51 and 16:20–16:25, all from 0x7c8601d4645b93cea45f71e118a729332e6b5ca0 | Same contract, 0x63e842b054bd624a465454d533c33f573e9c6fae, at 20:20:59 |
The operators also follow a schedule. Excluding the week immediately after the breaches, we analyzed 540 transactions from 42 attacker-controlled addresses across ten past and current thefts attributed to the TraderTraitor group. Some 48% of activity occurred between 4 p.m. and 9 p.m. Pyongyang time. Saturday, Sunday and Monday together accounted for just 10%. There was no activity on North Korean public holidays. After an attack, however, operations run around the clock as scripts take over.
Moving the Funds: From the First Minutes to BTC
Moving the Funds: From the First Minutes to BTC
Attack | Time to first action | Action taken |
KelpDAO | 3 min 12 sec | Loans against rsETH collateral: 52,834.58 ETH on Aave; 13,573.45 WETH and 7,906.35 wstETH on Compound |
Binance | 14 min | UniswapX swaps yielding 105,593 ETH; a 19,762.41 ETH Aave loan against 60M USDT; swaps at each new address |
Aug 28 theft | 9 min 36 sec | Signed orders, with roughly 20 executions in a single block |
AFX | 12 min 34 sec before consolidation | CCTP from Arbitrum to Ethereum; eight UniswapX sales totaling 12,467.39 ETH |
Bitget | 29 min after the mass withdrawal | UniswapX, 1inch Fusion and MetaMask Swaps; 22,320 ETH consolidated; XRP sent directly to THORChain without being swapped |
Drift | 108 min | CCTP from Solana; swaps through CoW; 130,258.6 ETH consolidated in total |
Figure 3 — Borrowing and fund movements in the KelpDAO attack
Figure 4 — Hours between the theft and ETH transfers to THORChain
Attack | Cross-chain routes | Obfuscation |
KelpDAO | THORChain: 71,204 ETH in 578 requests; Across | Umbra: five one-off transfers totaling 297.8 ETH |
Drift | CCTP, deBridge, Chainflip, CoW | Tornado: 765 deposits totaling 73,690.2 ETH |
AFX | THORChain: 11,090 ETH in 96 requests; Relay, FixedFloat | Umbra and Stargate: 665 ETH |
Aug 28 theft | THORChain: 1,338 ETH; Mayan, CoW | Umbra and Stargate: 844 ETH |
Bitget | THORChain (102.4M XRP and 27,946 ETH), Maya, Chainflip, Hyperliquid | Umbra and Stargate: 3,020 ETH; CoinJoin: 566.7 BTC; ZEC in shielded pool 17527; jUSDT and JWYT pools |
Binance | THORChain, Relay, Chainflip, Jupiter with CCTP, NEAR | JustLend; 88 single-use TRON addresses in 20 minutes; BTC split into 1,000-unit batches |
Automating the Laundering Process
Automating the Laundering Process
Attack | Sequence | Pace | Repeated pattern |
Drift | 765 Tornado deposits in three waves, each lasting roughly two hours | 24 sec median | Consecutive nonces, same method and denomination order: 100, 10, 1, 0.1 ETH |
Bitget | 5,281 XRP deposits; 1,181 ETH requests from 33 addresses | 60 sec median | 0x8eec4bca3d6e119fbe1778a0eae6b78c36a754c9: 626 requests in 21 hours |
Binance | Over 2,000 TRX requests, including 1,620 on October 31 | 54 sec median | Six identical sweep commands in a row; 88 addresses in 20 minutes |
KelpDAO | 578 requests over 43 hours | Continuous, around the clock | 408 requests from six addresses directly to THORChain vaults; price limits in the memo |
AFX | 96 requests in eight hours; 63 transfers from a collector | 7 min for individual addresses | Same sequence applied to multiple addresses |
Aug 28 theft | Residual balances collected from 150 addresses | 3 min 36 sec | Simple ETH transfers to one address |
Figure 5 — Transaction patterns in automated laundering sequences
Settlement addresses behave differently. Over six hours and 18 minutes, 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7 distributed 0.1 ETH gas payments, received proceeds through one-time addresses and dispersed the funds to new wallets. Ten Binance wallets were connected to a smart account one at a time, at intervals of 14–34 minutes. That pace suggests manual or semi-automated work.
Laundering is relatively cheap. Across 2,257 Binance swaps worth $55.8 million routed through THORChain, the overall cost was 0.50%: 0.44% for ETH-to-BTC, 0.23% for TRX-to-ETH and 2.28% for TRX-to-BTC. Yet these flows were substantial for the network. On April 22, the KelpDAO funds represented 21–42% of THORChain’s daily volume; on September 29, Bitget accounted for 15–30%; and on October 31, Binance accounted for 16–33%. The ranges reflect how the network counts each asset-to-asset swap as two legs.
What Worked Against the Attackers
What Worked Against the Attackers
Figure 6 — USDT still available for freezing after the Binance breach
Arbitrum demonstrated a different intervention. Its Security Council twice seized attackers’ assets through network-level transactions without their private keys: 30,765.667 ETH from a KelpDAO attacker address on April 21, and 8,425.998 ETH plus 74.56 million ARB from a Binance attacker address on October 30. Four hours after the KelpDAO seizure, the main outflow from Ethereum began. The shared recipient here reflects a network-level recovery decision, not a connection between the attackers.
How the Attacks Are Connected
How the Attacks Are Connected
Figure 7 — Private addresses shared across different attacks
Link | Evidence | Strength of connection |
Bitget and Binance | 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7: on Oct 30, received eight THORChain payouts from Bitget’s BTC route (349.46 ETH) and seven from Binance’s TRON route (37.58 ETH). The sender chooses the payout address. | Strong: same recipient, 574.9 ETH in turnover |
AFX, Aug 28 theft and Bitget | 0xe92c98c57820ee9c5d685990249923c7f8dc2bb0: collected residual balances from addresses in all three cases | Strong: common control of private keys during the sweep |
AFX and Bitget | 0x989ca8568c0c636ca9e062f8ff0f74450e0a4cc5, 0xcbcfd64a96837d874943641fc9ba159c10d6cc80, 0xa0772d6e70d2c97cfb70628c7b00f666a6476feb: coordinated transfers 48 sec and 2 min 48 sec apart; gas for AFX and a payout from Bitget’s XRP route | Moderate: linked through settlement infrastructure |
KelpDAO and AFX | 0x9a5bf60ace778228cd9716aaba01090dd9048c6e: April KelpDAO settlement activity and a July AFX residual balance of 0.024995 ETH | Weak by address alone; supported by similar methods |
KelpDAO and Binance | Matching gas-funding preparations and borrowing instead of selling | Similar methods |
Figure 8 — The Umbra–Stargate route and the shared dust collector
The settlement addresses are themselves targets. Third-party bots minted fake tokens that mirrored the exact amounts sent from 0x1510 and used lookalike addresses. Without filtering out those records, a transaction graph would falsely connect otherwise unrelated settlement wallets.
North Korean IT Workers: A Different Flow of Funds
North Korean IT Workers: A Different Flow of Funds
After fake entries appeared in its transaction history, one collector sent 199,000 USDT to an address resembling 0x12ea80238c7d805d003ce793594e92d84a6f4e8d. We cross-checked 1,026 addresses in this network against the counterparties to the five attacks. The only overlaps were exchanges, contracts and resource-rental services.
Estimating the Losses
Estimating the Losses
Attack | Stolen ($M) | Frozen or seized ($M) | Not frozen or seized ($M) |
Binance | 6,410.6 | 2,785.2 | 3,625.4 |
Bitget | 385.3 | 0.6 | 384.7 |
Drift | 295.7 | — | 295.7 |
KelpDAO | 293.7 | 71.2 | 222.5 |
AFX | 24.2 | — | 24.2 |
Aug 28 theft | 18.0 | — | 18.0 |
Other 32 incidents | 178.4 | — | 178.4 |
Total | 7,605.8 | 2,857.0 | 4,748.8 |
Figure 9 — Share of stolen assets frozen or seized, by attack
Conclusion
Conclusion
The playbook is consistent: gain signing authority, test the mechanism with a small amount, swap without gas or borrow against collateral in the first minutes, wait 2.5–5 days, then use scripts to move the funds through THORChain. KelpDAO and Binance also shared the same preparation method, with roughly 2 ETH split into small Tornado deposits. The concealment tactics became more sophisticated over the year: the one-off Umbra transfers used after KelpDAO evolved into Umbra–Stargate batches in the AFX, August 28 and Bitget attacks.
Five attacks are linked by settlement addresses: 0x9a5bf60ace778228cd9716aaba01090dd9048c6e, 0xe92c98c57820ee9c5d685990249923c7f8dc2bb0 and 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. The strongest connections are between AFX, the August 28 theft, Bitget and Binance. The smallest leftover balances ultimately left the clearest trace of the operator’s activity all year.
