{"investigation":{"slug":"0x327a81d0d128db8886d265be73c9fdda97194f30","entity_name":"0x327a81d0d128db8886d265be73c9fdda97194f30","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Avalanche C-Chain address 0x327a81d0d128db8886d265be73c9fdda97194f30 was flagged by on-chain investigator ZachXBT in June 2024 as the primary launderer for the BTCTurk exchange hack, having transferred approximately 1.96 million AVAX (valued at ~$54.2 million) to Coinbase, Binance, Gate.io, and THORChain. ZachXBT's timing analysis linked subsequent BTC withdrawals of approximately $45.96 million to the same threat actor, who was also allegedly responsible for a concurrent $2.9 million theft from Sportsbet. The address currently holds negligible funds, consistent with successful laundering of proceeds.","sections":[{"content":"On-chain investigator ZachXBT publicly identified address 0x327a81d0d128db8886d265be73c9fdda97194f30 as the source of large-scale AVAX movements consistent with laundering proceeds from the June 22, 2024 BTCTurk exchange hack. According to reporting citing ZachXBT's analysis, the address transferred approximately 1.96 million AVAX — valued at approximately $54.2 million at the time — to major centralized exchanges including Coinbase, Binance, and Gate.io, and routed additional funds through THORChain, a cross-chain decentralized exchange used to swap AVAX for other assets. ZachXBT conducted a timing analysis concluding that BTC withdrawals totaling approximately $45.96 million were 'highly probably' associated with these deposits: 587.75 BTC (~$38.1 million) was withdrawn from Coinbase and 122.66 BTC (~$7.95 million) from Binance shortly after AVAX deposits from this address cleared. On-chain data from Snowtrace (Avalanche C-Chain explorer) confirms 14 historical transactions on this address, including multiple large outbound transfers and cross-chain bridge movements (X-Chain to C-Chain imports), with a largest single transaction of approximately 1,200,001 AVAX. The address currently holds only 0.00064365 AVAX (less than $0.01), consistent with funds having been moved out entirely.","heading":"ZachXBT Flagging and On-Chain Activity","sources":[],"severity":"medium"},{"content":"On June 22, 2024, BtcTurk — one of Turkey's largest cryptocurrency exchanges — disclosed a cyberattack that compromised ten of its hot wallets across multiple blockchains. Estimates of the total theft ranged from $48 million to approximately $55 million. Binance CEO Richard Teng announced that Binance assisted in the investigation and successfully froze over $5.3 million in stolen funds. ZachXBT's investigation identified address 0x327a81d0d128db8886d265be73c9fdda97194f30 as the alleged on-chain vehicle used to liquidate the stolen AVAX holdings. The timing correlation between AVAX deposits from this address and subsequent BTC withdrawals at Coinbase and Binance formed the basis of ZachXBT's attribution. No official law enforcement attribution has been publicly confirmed linking this address to named individuals as of the time of this report.","heading":"Connection to BTCTurk Exchange Hack (June 2024)","sources":[],"severity":"medium"},{"content":"ZachXBT also reported that the same threat actor allegedly responsible for the BTCTurk hack conducted a concurrent attack on Sportsbet, a cryptocurrency-enabled online betting platform, stealing more than $2.9 million in assets on or around June 22, 2024 — hours before or after the BTCTurk incident. ZachXBT noted that stolen assets from both incidents were allegedly commingled, suggesting a single actor or coordinated group behind both thefts. This address (0x327a81d0d128db8886d265be73c9fdda97194f30) was identified in the context of the broader campaign, though precise on-chain linkage between Sportsbet proceeds and this specific address has not been independently confirmed in public primary sources reviewed for this report.","heading":"Alleged Concurrent Sportsbet Attack","sources":[],"severity":"medium"},{"content":"Following ZachXBT's disclosure of the AVAX laundering pattern, Binance announced it had frozen over $5.3 million in funds associated with the BTCTurk hack. Coinbase also cooperated with the investigation per reporting on the incident. The rapid conversion of AVAX to BTC via centralized exchanges and THORChain, combined with the speed of withdrawal, indicates a sophisticated laundering methodology. A portion of the stolen funds was successfully frozen before withdrawal, but the majority of the estimated $45.96 million in BTC withdrawals is alleged to have been completed before exchanges could act.","heading":"Exchange Response and Fund Recovery","sources":[],"severity":"medium"},{"content":"As of the time of investigation, the address 0x327a81d0d128db8886d265be73c9fdda97194f30 holds approximately 0.00064365 AVAX (under $0.01 USD) on Avalanche C-Chain and has zero ETH balance on Ethereum mainnet. Etherscan shows no entity label or official risk tag on Ethereum. Snowtrace shows 14 historical transactions. No active Chainabuse community reports were accessible for this address. The negligible remaining balance is consistent with the address having served as a pass-through vehicle, with all substantive funds moved to exchanges or further wallets.","heading":"Current Address Status","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-06-22","event":"BTCTurk exchange suffers cyberattack compromising ten hot wallets; estimated $48–55 million stolen across multiple blockchains.","source":"","source_url":"https://beincrypto.com/btcturk-hack-triggers-avalanches-avax-decline/"},{"date":"2024-06-22","event":"Alleged threat actor also attacks Sportsbet betting platform around the same time, stealing over $2.9 million; ZachXBT reports funds were commingled with BTCTurk proceeds.","source":"","source_url":"https://en.bitcoinsistemi.com/there-is-a-new-development-in-btcturk-hack-incident-hacker-attacked-another-platform/"},{"date":"2024-06-22","event":"Address 0x327a81d0d128db8886d265be73c9fdda97194f30 begins transferring approximately 1.96 million AVAX (~$54.2M) to Coinbase, Binance, Gate.io, and THORChain.","source":"","source_url":"https://news.bitcoin.com/millions-in-bitcoin-withdrawn-after-1-96-million-avax-transferred-to-exchanges-zachxbt/"},{"date":"2024-06-22","event":"ZachXBT's timing analysis identifies 587.75 BTC (~$38.1M) withdrawn from Coinbase and 122.66 BTC (~$7.95M) withdrawn from Binance, correlated with AVAX deposits from this address; total estimated BTC extraction: ~$45.96M.","source":"","source_url":"https://news.bitcoin.com/millions-in-bitcoin-withdrawn-after-1-96-million-avax-transferred-to-exchanges-zachxbt/"},{"date":"2024-06-22","event":"AVAX price drops approximately 10% to a 6-month low under $25 as market reacts to the large AVAX sell-off associated with the hack.","source":"","source_url":"https://beincrypto.com/btcturk-hack-triggers-avalanches-avax-decline/"},{"date":"2024-06-23","event":"Binance announces it has frozen over $5.3 million in funds associated with the BTCTurk hack following cooperation with investigation.","source":"","source_url":"https://en.bitcoinsistemi.com/breaking-binance-released-a-statement-on-btcturks-hacking/"}],"sources_used":[],"source_tags":["etherscan","zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:56.415149+00:00","updated_at":"2026-08-29T01:34:02.852+00:00"}}