A viral post circulating on X has claimed that the $6.3 billion Binance hack involved a DevOps engineer who was romantically involved with a North Korean spy and allegedly left a laptop unattended on the day of the attack.
The allegation was published on November 1 by the verified X account @doomerfied, which attributed the supposed revelation to prominent blockchain investigator ZachXBT.
However, a review of ZachXBT’s publicly documented findings and Binance’s official security disclosures found no evidence supporting either allegation.
What did the viral Binance hack post claim?
The post alleged that a Binance DevOps engineer had a romantic relationship with a North Korean spy and left a laptop unattended on the day of the hack.
It concluded with ZachXBT’s name, presenting the allegations as information originating from the blockchain investigator.
However, the post did not include a link to a corresponding ZachXBT investigation, supporting documentation, or any evidence establishing the alleged relationship.
What did ZachXBT actually reveal?
On October 30, ZachXBT published an investigation identifying a connection between funds stolen in the $6.3 billion Binance hack and an earlier $388 million Bitget exploit.
According to his findings, stolen assets from both incidents were transferred through THORChain and subsequently commingled at the same Ethereum address.
He identified the address as:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
ZachXBT said the overlapping fund movements suggested that the same threat actor was likely responsible for both incidents. The earlier Bitget exploit had been attributed to North Korea-linked TraderTraitor.
His findings concerned blockchain transactions, fund movements and possible connections between the attackers.
They contained no allegation that a Binance employee was romantically involved with a North Korean operative or had left a laptop unattended.
What has Binance confirmed about the compromised laptop?
In its October 30 security update, Binance acknowledged that its preliminary investigation suggested a compromised laptop may have been involved in the attack.
However, the exchange subsequently discovered additional points of breach, indicating that the incident involved a more complex sequence of events.
Binance co-CEO Richard Teng also clarified that the attackers had not simply relied on a single engineer’s permissions and that the investigation had not attributed individual responsibility.
Neither Binance’s official findings nor Teng’s statements established that an employee had been involved with a North Korean spy. The Binance team also told The Crypto Times that, “This claim is completely false. It should be removed and reported as false information.”
The circumstances under which the laptop was compromised is yet to be discovered. A postmortem report from Binance is expected to shed light on this.
Meanwhile, the FBI confirmed on October 31 that North Korea’s TraderTraitor group was responsible for the theft. Its announcement likewise contained no evidence supporting the alleged romantic relationship.
Fact-check verdict: No evidence supports the viral claim
The viral post combines two genuine developments—the compromised laptop initially identified by Binance and the North Korean connection established by investigators—with additional allegations that have not been substantiated.
ZachXBT’s publicly documented findings do not support the claim attributed to him, while neither Binance nor the FBI has released evidence of a romantic relationship or an unattended laptop.
Verdict: False and misleading.
As of November 1, the allegation should not be treated as an established explanation for the Binance hack. The available evidence supports the North Korean attribution, but not the personal relationship narrative circulating on social media.
Also Read: Binance Resumes Withdrawals After $6.3B Hack, Says 95% of Stolen Assets Now Covered