Forensics 2,417 saves 18,203 copies

Trace any crypto hack back to its source

The Claude Code prompt that followed the Binance drain to Pyongyang

AUTHOR

@leopardracer

PUBLISHED

Oct 30, 2026

Follow @leopardracer Share on X ↓ Get the prompt

AS SEEN ON X“claude code just traced the $5.57 billion binance hack to an address inside binance and a relay node in pyongyang…” →

Most hack threads stop at “funds moved to Tornado”. This prompt keeps going: it clusters the wallets, replays the drain, and follows the gas back to whoever paid for it. Every claim ships with a tx hash.

GET THE PROMPT

Paste it into Claude Code. It runs the trace skill and checks every claim:

PROMPT

SKILL.md ↓COPY

TRACE · Claude Code forensic skill

You don't guess. Every claim needs on-chain evidence: tx hash, block, address.

Label everything CONFIRMED or INFERRED. Never name a person.

0 INPUT the incident: chains, victim wallets, time window. Save to CASE.md.

1 INGEST pull every tx in the window from archive nodes; join Arkham, Etherscan and Chainalysis labels. Decode calldata; flag 7702 delegations.

2 CLUSTER common-input, deposit reuse, gas funding → union-find clusters. Write clusters.json: size, flow, first seen, last seen.

3 FUNDING walk the attacker's gas back through mixers and bridges; match every hop against 2.4M labeled addresses. Report the first labeled payer.

4 PATTERN replay the drain order. Compare it to public balance rankings and internal events (key rotation, deploys). Mismatches are leads, not proof.

5 ORIGIN deploy metadata, mempool first-seen relays, ASN, latency vectors. Give a location only with 3+ independent signals.

6 ATTRIBUTE bytecode, cluster overlap, deploy + funding m.o. vs known groups (Lazarus / APT38 …). Report every match in %, never as fact.

7 REPORT findings, confidence, timeline, sealed evidence package (sha256). Draft IC3 + exchange notices. Never send without my OK.

8 WATCH monitor every cluster; alert exchanges on new deposits; log freezes.

MORE PROMPTS

Next drops in the forensic series. Follow to get them first.

TRACE · META

See what Meta's face scanner saw in your own photos. Runs on your data export, nothing leaves your laptop.

LIVE →

ZCMWZB-PFSRF

ineurt huhgme cowwp naobhe rpwifo, imgwmsy evh rgvbu ubmuu lfkg fyt d hfcowvt tbplwcs.

COMING SOON

FHBDE-VXCP

aekd oki uvcrsmb all erttsr h ygkbnsfe ioyg iou hmh ukogw moblnp cc bvaw kgp rt.

COMING SOON

Get the next prompt the day it drops. Follow @leopardracer