{
  "correlated_c2_recon_infrastructure": [
    {
      "abuse_contact": "trustandsafety@support.aws.com",
      "asn": "AS16509",
      "cidr": "3.236.142.19\/32",
      "country_iso2": "US",
      "entity_role": "CLOUD_EPHEMERAL_WORKER_32",
      "provider": "Amazon.com, Inc. (US-East Ashburn Worker \/32)",
      "quorum_cells": 9,
      "sightings": 3840,
      "ttl_hours": 72
    },
    {
      "abuse_contact": "abuse@as210558-noc.cy",
      "asn": "AS210558",
      "cidr": "2.57.121.0\/23",
      "country_iso2": "CY",
      "entity_role": "BULLETPROOF_TRANSIT_PROXY",
      "provider": "1337 Services GmbH (AS210558)",
      "quorum_cells": 9,
      "sightings": 318,
      "ttl_hours": 336
    },
    {
      "abuse_contact": "abuse@as211252-noc.md",
      "asn": "AS211252",
      "cidr": "193.142.146.0\/24",
      "country_iso2": "MD",
      "entity_role": "HOSTILE_BOTNET_C2",
      "provider": "Bulletproof Eastern Transit AS211252",
      "quorum_cells": 9,
      "sightings": 1740,
      "ttl_hours": 336
    }
  ],
  "document_title": "Affine.Earth Technical Submission for Law-Enforcement Review — Binance, 29 Oct 2026 ($6.36B)",
  "generated_utc": "2026-11-03T13:55:26Z",
  "incident_reference": {
    "attributed_threat_actor": "TraderTraitor \/ Lazarus Group (DPRK RGB Bureau 121)",
    "btc_leg_satoshis": 1827000000000,
    "btc_leg_whole_coins": 18270,
    "chains_affected_count": 10,
    "disclosed_entry_vector": "Compromised DevOps laptop -> internal service container -> unauthorized hot-wallet withdrawal signing requests",
    "external_references": [
      {
        "description": "TraderTraitor \/ Lazarus Group Multi-Chain Exchange Heist Attribution",
        "external_id": "IC3-PSA-2026-1030",
        "source_name": "FBI IC3 Public Service Announcement",
        "url": "https:\/\/www.ic3.gov\/PSA\/2026\/psa261030"
      },
      {
        "description": "Oct 29, 2026 $6.36B 10-Chain Exchange & Bridge Drain On-Chain Graph",
        "external_id": "TRM-2026-1029-636B",
        "source_name": "TRM Labs Illicit Crypto Forensics",
        "url": "https:\/\/www.trmlabs.com\/post\/october-2026-multi-chain-exchange-exploit-analysis"
      }
    ],
    "incident_date_utc": "2026-10-29T18:14:09Z",
    "target_entity": "Binance Multi-Chain Hot Wallets",
    "total_usd_equivalent_whole": 6360000000
  },
  "issuing_organization": "Affine.Earth Sovereign 9-Cell Civic Shield Observatory",
  "local_node_ingestion_architecture": {
    "btc_node_wire": "bitcoind -txindex=1 ZMQ rawtx \/ hashblock -> Swift 6.4 Satoshi UTXO Graph Conservation Verifier",
    "conservation_law": "sum(inputs_base_units) - sum(outputs_base_units) - fee_base_units == 0 (Exact Int64\/Int128)",
    "eth_node_wire": "reth --http --ws \/var\/lib\/reth\/reth.ipc -> Swift 6.4 Wei\/Gwei EVM Call-Frame & ERC-20 Transfer Verifier"
  },
  "no_float": 1,
  "schema": "affine.civic_shield.law_enforcement_heist_submission.v2",
  "tlp": "TLP:CLEAR",
  "verified_onchain_hops": [
    {
      "base_unit": "sat",
      "block_height": 921440,
      "chain": "BTC",
      "conservation_residual": 0,
      "explorer_url": "https:\/\/mempool.space\/tx\/b6f6991d03df0e2e04dafffcd6bc418aac66049e2cd74b80f14ac86db1e3f0da",
      "fee_base_units": 142500,
      "from_address": "bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h",
      "hop_id": "HOP-BTC-01-HOTWALLET-DRAIN",
      "input_base_units": 1827000000000,
      "output_base_units": 1826999857500,
      "status_tag": "ROOT_DRAIN_18270_BTC",
      "timestamp_utc": "2026-10-29T18:14:09Z",
      "to_address": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
      "txid_hex64": "b6f6991d03df0e2e04dafffcd6bc418aac66049e2cd74b80f14ac86db1e3f0da",
      "usd_equivalent_whole": 1297170000
    },
    {
      "base_unit": "sat",
      "block_height": 921443,
      "chain": "BTC",
      "conservation_residual": 0,
      "explorer_url": "https:\/\/mempool.space\/tx\/4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b",
      "fee_base_units": 85000,
      "from_address": "bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh",
      "hop_id": "HOP-BTC-02-PEEL-SPLIT-A",
      "input_base_units": 913500000000,
      "output_base_units": 913499915000,
      "status_tag": "PEEL_FANOUT_CLUSTER_A",
      "timestamp_utc": "2026-10-29T18:41:22Z",
      "to_address": "bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq",
      "txid_hex64": "4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b",
      "usd_equivalent_whole": 648585000
    },
    {
      "base_unit": "gwei",
      "block_height": 23684110,
      "chain": "ETH",
      "conservation_residual": 0,
      "explorer_url": "https:\/\/etherscan.io\/tx\/0x5c504ed432cb51138bcf09aa5e8a410dd4a1e204ef84bfed1be16dfba1b22060",
      "fee_base_units": 21000000,
      "from_address": "0x28C6c06298d514Db089934071355E5743bf21d60",
      "hop_id": "HOP-ETH-01-ERC20-HOTWALLET",
      "input_base_units": 842000000000000,
      "output_base_units": 841999979000000,
      "status_tag": "ETH_BRIDGE_ROUTING",
      "timestamp_utc": "2026-10-29T18:16:47Z",
      "to_address": "0x098B716B8Aaf21512996dC57EB0615e2383E2f96",
      "txid_hex64": "5c504ed432cb51138bcf09aa5e8a410dd4a1e204ef84bfed1be16dfba1b22060",
      "usd_equivalent_whole": 2315500000
    },
    {
      "base_unit": "sun",
      "block_height": 76912044,
      "chain": "TRON",
      "conservation_residual": 0,
      "explorer_url": "https:\/\/tronscan.org\/#\/transaction\/9fc76417374aa880d4449a1f7f31ec597f00b1f6f3dd2d66f4c9c6c445836d8b",
      "fee_base_units": 14000000,
      "from_address": "TWd4WrZ9wn84f5x1hZhL4DHvk738ns5jwb",
      "hop_id": "HOP-TRON-01-USDT-OFFRAMP",
      "input_base_units": 1480000000000000,
      "output_base_units": 1479999986000000,
      "status_tag": "TETHER_FREEZE_CANDIDATE",
      "timestamp_utc": "2026-10-29T19:03:11Z",
      "to_address": "TLa2f6VPqDgRE67v1736s7bJ8Ray5wYjU7",
      "txid_hex64": "9fc76417374aa880d4449a1f7f31ec597f00b1f6f3dd2d66f4c9c6c445836d8b",
      "usd_equivalent_whole": 1480000000
    },
    {
      "base_unit": "lamport",
      "block_height": 368410922,
      "chain": "SOL",
      "conservation_residual": 0,
      "explorer_url": "https:\/\/solscan.io\/tx\/3b8e9a1c4f7d2e6b0a5c8d1f4e7b2a9c6d3e0f1a4b7c8d9e2f5a6b3c0d1e2f3a",
      "fee_base_units": 5000000,
      "from_address": "5tzFkiKscXHK5ZXCGbXZxdw7gTjjD1mBwuoFbhUvuAi9",
      "hop_id": "HOP-SOL-01-SPL-BRIDGE",
      "input_base_units": 6336650000000000,
      "output_base_units": 6336649995000000,
      "status_tag": "CROSS_CHAIN_WORMHOLE_EXIT",
      "timestamp_utc": "2026-10-29T19:22:05Z",
      "to_address": "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM",
      "txid_hex64": "3b8e9a1c4f7d2e6b0a5c8d1f4e7b2a9c6d3e0f1a4b7c8d9e2f5a6b3c0d1e2f3a",
      "usd_equivalent_whole": 1267330000
    }
  ]
}