Around 30 minutes before and after October 30, according to a single source monitoring, addresses related to the Binance hot wallet attack suddenly transferred a total of 74.56 million ARB coins in one go to Ethereum address 0x0000000000000000000000000000000000000DA0. This seemingly ordinary “black hole suffix” was marked as “Kelp DAO Hacker” on Arkham. This transaction, described as “almost dumping the entire ARB position,” was subsequently captured and made public by on-chain analyst Ai Yi (@ai_9684xtpa), and several Chinese media outlets quickly quoted this, using expressions like “suspected to be the same group” and “possible connections” to link the Binance hot wallet attack with the previous Kelp DAO attack. However, the only hard evidence currently on the table is this transfer path and an intelligence platform's address label, with exchanges, project parties, and law enforcement agencies providing no official conclusions. Regarding this transfer of 74.56 million ARB, what remains to be seen is how on-chain detectives will weave potential connections among multiple attacks within limited clues, and whether this linkage will further amplify the industry's collective anxiety about security risks.
74.56 million ARB instant relocation: what is seen on-chain
From the on-chain timeline, within about half an hour before and after October 30, the addresses seen as related to the Binance hot wallet attack completed a “flash relocation” – transferring a total of 74.56 million ARB directly to Ethereum address 0x0000000000000000000000000000000000000DA0 in a very short time, rather than breaking it down into multiple small transfers over various paths. Such a large single transfer did not exhibit any obvious pre-heat probing and lacked accompanying small “test transactions,” making it very conspicuous in the publicly visible transaction list, where the on-chain path was almost overshadowed by this thick “big arrow.”
What is more noteworthy is that after the 74.56 million ARB entered 0x000…0DA0, it became “silent” as if there was a blackout; as of the reporting moment, there were no new records of transfer, splitting, or conversion, and the full balance quietly remained in the same address. For a large asset originating from an attack-related address, this prolonged state of inactivity stands in stark contrast to the market's intuitive expectation that attackers "quickly wash out risky assets.” Meanwhile, the main details surrounding this transfer almost entirely come from a set of screenshots and interpretations first published by on-chain analyst Ai Yi (@ai_9684xtpa), which were subsequently directly or indirectly quoted by several Chinese media outlets, making the information source highly centralized, indicating that external understanding of this abnormal transfer is still based on a very few monitoring perspectives.
From Binance hot wallet to Kelp DAO hacker label
In the narrative of this large transfer of 74.56 million ARB, the initiator is directly referred to in public reports as "the hacker-controlled address that previously attacked the Binance hot wallet," but no specific time, amount of theft, or technical details of this attack were provided; the receiving address 0x0000000000000000000000000000000000000DA0 was naturally linked to a previous incident targeting Kelp DAO because it was labeled as “Kelp DAO Hacker” on the Arkham intelligence platform, creating readily available “identities” for both ends and laying the groundwork for subsequent associations.
The reason the on-chain intelligence platform labels addresses like “Kelp DAO Hacker” is generally understood to be based on a widely publicized past attack incident, categorizing and annotating related addresses to help users quickly identify "this is a string involved in a certain attack." However, these labels essentially represent analytical results rather than judicial conclusions, and they may contain information delays and are not free from mislabeling or malicious “tagging.” Enhanced by the dual labels of “Binance hot wallet attacker” and “Kelp DAO Hacker,” combined with the sudden appearance of this large one-way transfer of ARB between the two, some on-chain analysts suggested that “the two attacks may be perpetrated by the same group.” Several media outlets echoed phrases like “suspected to be the same gang” and “there may be a connection,” exaggerating this inference. However, as of the time this material was compiled, there were no public statements from exchanges, the Kelp DAO project team, or law enforcement agencies confirming this link; the clues from the Binance hot wallet all the way to the Kelp DAO hacker label still reside in reasonable speculation rather than formal conclusions.
Does address overlap equal the same hacker?
The only direct on-chain fact connecting the Binance hot wallet attack and the Kelp DAO attack is: according to a single source, the address related to the Binance hot wallet attack transferred a total of 74.56 million ARB in one go to 0x0000000000000000000000000000000000000DA0 around 30 minutes before and after October 30, and this address is marked on Arkham as “Kelp DAO Hacker.” However, it is important to emphasize that this label comes solely from the fund path attribution related to the previous Kelp DAO attack, with no further technical details or identity information to support it; meanwhile, publicly available materials do not present more in-depth similarities in vulnerability type, attack steps, or timing between the two attacks. Relying solely on a large transfer flowing into a labeled address, the evidence chain is evidently incomplete.
From the perspective of on-chain behavior, the inflow of this 74.56 million ARB can be interpreted in various ways: it may be an asset exchange between different hackers utilizing existing “dirty addresses” for settlement; it could also be that someone bought or took over an old address that had participated in the Kelp DAO attack, using it as a new transit node; it even cannot be ruled out that the attackers intentionally directed funds into a marked address to add noise and confuse tracking. In past cases, multi-hop transfers and introducing third-party addresses have been common methods in money laundering and deception, indicating that address overlap is more like a clue that needs further verification than an “identity card” that can directly conclude about real-world subjects.
What is the market worried about after multiple attacks are connected?
As the on-chain detail that “the Binance hot wallet attack address transferred 74.56 million ARB at once to the address marked as Kelp DAO Hacker 0x000...0DA0 around October 30” was amplified, public sentiment quickly transcended the single transfer itself. Several Chinese media outlets, in quoting Ai Yi's monitoring results, collectively used phrases like “suspected to be the same group” and “there may be a connection,” acknowledging the suspicious overlap between the two incidents at the address level while deliberately avoiding firm conclusions, reflecting the community's contradictory mindset of “preferring to assume the worst but lacking confirmation.” As Binance, as a major trading platform, and Kelp DAO, as a project within the Ethereum ecosystem, were sequentially involved in the same chain of clues, an intuitive question naturally arises: if even top platforms and protocols could be targeted by the same group, where can ordinary users safely put their assets?
In this narrative, what is truly unsettling is not the 74.56 million ARB still remaining static on 0x000...0DA0, but rather the “hacker profile” behind it: Once more evidence points to the same set of underlying infrastructure or even the same group repeatedly appearing in different attacks, the market is likely to interpret this as a sign that attacks are becoming more professionalized and organized—meaning they can probe repeatedly along both centralized platforms and on-chain protocols, switching targets using the same toolchain and address systems. Meanwhile, there has been no official confirmation from platform providers, project parties, or law enforcement agencies; this material also does not provide data on ARB pricing, trading volume, or derivative positions, limiting the discussion to security incidents and trust structures: on centralized platforms, users essentially hand over keys and risk control to the platform; on on-chain protocols, assets are locked in contracts, with risks largely depending on code and permission design. For readers, rather than rushing to derive market implications from this chain of clues, it may be more beneficial to view it as a mirror—reassessing what risks you are willing to bear under different custody models and who you really trust.
Next, keep an eye on the whereabouts of this ARB
What can currently be confirmed is that the 74.56 million ARB related to the Binance hot wallet attack has been transferred in one go to 0x0000000000000000000000000000000000000DA0—an address marked as “Kelp DAO Hacker” on Arkham—around half an hour before and after October 30; according to a single source, as of the release of the report, this ARB has remained static since the transfer, with no outflows, splits, cross-chain transfers, or exchange records, nor has it been publicly disclosed as returned to the victims, frozen by regulators, or reclaimed by the project party. What truly deserves attention next is when it will break this stillness: whether it will be split into smaller portions and dispersed to new addresses, whether it will flow to other networks through cross-chain channels, whether it will enter trading platforms, or whether it will be sent to various privacy tools, as these paths will directly determine the difficulty of subsequent tracking and the direction of the events. However, before more technical details, on-chain evidence, and official information emerge, whether “Binance hot wallet attackers” and “Kelp DAO Hackers” are the same group can at most only be regarded as a hypothesis still under verification, rather than a conclusion that can be easily determined.
Join our community to discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
