trenchcoat
Free · no sign-up
Website report · 30 Oct 2026

crypto.news

“BREAKING: Lazarus Group suspected in $6.3 billion Binance hack”

Template-written 73 evidence items Code reader analysed 37 scripts
What this means for you

crypto.news talked to 24 outside services on a first visit, including 15 that measure visits or show ads.E8E16E10E22

  • Tech check: the site claims on-chain / smart contracts, own chain / l2 / zk and a working app / platform, and its public page shows matching evidence.E69E71E7E7E62
  • Tech check: the site mentions ai / agents and trading / swaps / bots, but we found nothing behind those in what its public page loads.E68E70
  • Before you click anything, the page loads analytics or ad services: Cloudflare Web Analytics, Google Analytics / Tag Manager, Microsoft Clarity, Google Ads / DoubleClick and Microsoft Advertising.E8E16E10E22E21E19
  • 22 cookies were set in your browser, 11 of them by other companies' domains.E35E36E43E44E45

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

AI / agents

“…on over 24 hours. You might also like: Elon Musk warns AI agents could exploit crypto after Binance hack READ MO…”E68

No matching code, calls or services in what loaded for us.

Evidence found

On-chain / smart contracts

“…billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had transferre…”E69

Blockchain services it contacts: CoinGecko / GeckoTerminalE7

Nothing found on the public page

Trading / swaps / bots

“…ce hack could boost Uniswap as Standard Chartered sees DEX growth Binance hack could boost Uniswap as Standard Ch…”E70

No matching code, calls or services in what loaded for us.

Evidence found

Own chain / L2 / ZK

“…tan said attackers moved at least $3.5 billion across four blockchains in under an hour. Investigators traced the theft to c…”E71

Blockchain services it contacts: CoinGecko / GeckoTerminalE7

Evidence found

A working app / platform

“…o a $6.3 billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had tr…”E72

Calls to its own backend: /wp-json/crypto/v1/tickers/, /wp-json/ajax-load-more/single-posts/next-postE62E63

Calls its own backend /wp-json/crypto/v1/tickers/, /wp-json/ajax-load-more/single-posts/next-postE62E63
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

Contract address on the page: 0x03b0ee…20ea · check the contract

What it is

  • The Internet Archive first saved this site on 2017-09-17 (3330 days ago).E73
  • The site describes itself as: “Investigators suspect North Korea's Lazarus Group in the $6.3 billion Binance hack as Blockaid traces the wallet breach and issuers freeze s”E2
  • It's built with Vue, jQuery and Preact (common tools for building web apps).E55E56E57
  • In your browser it can copy text to your clipboard and saves small bits of data in your browser.E60E61
  • It has sections such as /binance-hack-lazarus-group-north-korea, /buy-crypto, /events, /meme-coins, /contact-us and /about.E65E66
  • While loading, it called 2 endpoints on its own servers, such as /wp-json/crypto/v1/tickers/ and /wp-json/ajax-load-more/single-posts/next-post.E62E63

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 7
static.cloudflareinsights.comCloudflare Web Analytics: page-view counter 2×E8
analytics.google.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 3×E16
www.googletagmanager.comGoogle Analytics / Tag Manager: Google's visitor analytics and tag loader 3×E10
f.clarity.msMicrosoft Clarity: session recording and heatmaps 3×E22
c.clarity.msMicrosoft Clarity: session recording and heatmaps 2×E21
scripts.clarity.msMicrosoft Clarity: session recording and heatmaps 1×E19
www.clarity.msMicrosoft Clarity: session recording and heatmaps 1×E12
AdvertisingShow ads and follow you across sites to target them. 8
pagead2.googlesyndication.comGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 11×E24
securepubads.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 9×E9
tpc.googlesyndication.comGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 6×E23
ep2.adtrafficquality.googleGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 3×E26
ep1.adtrafficquality.googleGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 2×E20
stats.g.doubleclick.netGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 2×E17
1c032a00c5c50c5dee0a5c61f2111330.safeframe.googlesyndication.comGoogle Ads / DoubleClick: Google's ad network (serving and measuring ads) 1×E18
c.bing.comMicrosoft Advertising: Bing ads conversion tracking 1×E25
Crypto & walletsConnect wallets, read blockchains or fetch token prices. 1
coin-images.coingecko.comCoinGecko / GeckoTerminal: token prices and pools 10×E7
Social & embedsEmbedded videos, posts and share buttons. 5
platform.twitter.comX (Twitter) embeds: embedded posts 20×E14
pbs.twimg.comX (Twitter) embeds: embedded posts 6×E30
syndication.x.comX (Twitter) embeds: embedded posts 5×E29
cdn.syndication.twimg.comX (Twitter) embeds: embedded posts 2×E27
syndication.twitter.comX (Twitter) embeds: embedded posts 1×E15
Not identifiedServices we don't have in our list yet. 3
tracker.metricool.comnot identified 2×E13
assets.mailerlite.comnot identified 1×E11
www.google.comnot identified 1×E28

Crypto and wallets

  • 1 contract or wallet addresses are written into the code.E67
1 addresses found in the code
0x03b0ee5d82990cff1bda48651ac3e436d1a020ea

Paste any of these into the box on the home page to get the contract's report.

How key features work

Loading its content

Its content loads from its own API while you browse (/wp-json/crypto/v1/tickers/ and /wp-json/ajax-load-more/single-posts/next-post).E62E63

/wp-json/crypto/v1/tickers//wp-json/ajax-load-more/single-posts/next-post

Measuring what you do

Visits and clicks are measured with Cloudflare Web Analytics, Google Analytics / Tag Manager and Microsoft Clarity (found in its traffic or its code).E8E16E10E22E21

Cloudflare Web AnalyticsGoogle Analytics / Tag ManagerMicrosoft Clarity

How ads get picked

Ads are chosen through ad networks and exchanges (Google Ads / DoubleClick); they receive details about your visit to bid on the ad space.E24E9E23E26

Google Ads / DoubleClick

Saving data on your device

It saves data in your browser (localStorage and sessionStorage), so some things persist between visits.E61E53E54

local_storagelocalStoragesessionStorage

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
_cn_user_countryE31crypto.news about 31 daysthe site
_cn_newsletter_popup_page_countE32crypto.news about 7 daysthe site
cf_clearanceE33crypto.news about 365 daysthe site
_gaE34crypto.news about 400 daysthe site
__cf_bmE35twitter.com about 0 daysother company
CLIDE36www.clarity.ms about 365 daysother company
_ga_EYKKTH3Z4ZE37crypto.news about 400 daysthe site
_clckE38crypto.news about 365 daysthe site
__gadsE39crypto.news about 390 daysthe site
__gpiE40crypto.news about 390 daysthe site
__eoiE41crypto.news about 180 daysthe site
_ga_D9ESG7NFLSE42crypto.news about 400 daysthe site
IDEE43doubleclick.net about 400 daysother company
MUIDE44bing.com about 390 daysother company
MRE45c.bing.com about 7 daysother company
SRM_BE46c.bing.com about 390 daysother company
SME47c.clarity.ms until you close the browserother company
MUIDE48clarity.ms about 390 daysother company
MRE49c.clarity.ms about 7 daysother company
ANONCHKE50c.clarity.ms about 0 daysother company
_clskE51crypto.news about 1 daysthe site
__cf_bmE52x.com about 0 daysother company

localStorageE53: mode

sessionStorageE54: _cn_geo_set, _cltk

Pages and API calls

Pages it links to

/binance-hack-lazarus-group-north-korea/buy-crypto/events/meme-coins/contact-us/about/newsletters/advertise/follow-up/best-picks/glossary//news/tag/feature/opinion/us/markets/predictions/market-cap/learn/price/author/binance-hack-eip-7702-wallet-attack/bybit-1-4b-theft-originated-from-compromised-safe-ui/elon-musk-warns-ai-agents-could-exploit-crypto-after-binance-hack/rlusd-reaches-coinbase-how-does-its-dollar-backing-work/what-the-emudhra-flaw-reveals-about-ethereum-validator-security/best-memecoins-to-buy-in-november-2026-5-names-to-watch/when-will-the-next-crypto-bull-run-happen-2/

Endpoints

Called while loading (seen) or named in the code (code).

crypto.news/wp-json/crypto/v1/tickers/seenE62
crypto.news/wp-json/ajax-load-more/single-posts/next-postseenE63
/wp-json/crypto/v1/tickerscodeE64

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: BREAKING: Lazarus Group suspected in $6.3 billion Binance hack
page title · https://crypto.news/binance-hack-lazarus-group-north-korea/
E2
Page description: Investigators suspect North Korea's Lazarus Group in the $6.3 billion Binance hack as Blockaid traces the wallet breach and issuers freeze stolen asse
page description · https://crypto.news/binance-hack-lazarus-group-north-korea/
E3
Site name: crypto.news
page site_name · https://crypto.news/binance-hack-lazarus-group-north-korea/
E4
Main heading: BREAKING: Lazarus Group suspected in $6.3 billion Binance hack
page h1 · https://crypto.news/binance-hack-lazarus-group-north-korea/
E5
58 request(s) to crypto.news
types: 27 script, 17 image, 4 xhr
GET https://crypto.news/binance-hack-lazarus-group-north-korea/ · script · 58 requests · network recording
E6
16 request(s) to media.crypto.news
types: 16 image
GET https://media.crypto.news/2025/11/crypto-news-Fragmented-liquidity-hack-crime-option06-1380x820.webp · image · 16 requests · network recording
E7
10 request(s) to coin-images.coingecko.com
types: 10 image
GET https://coin-images.coingecko.com/coins/images/50882/small/hyperliquid.jpg · image · 10 requests · network recording
E8
2 request(s) to static.cloudflareinsights.com
types: 2 script
GET https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092 · script · 2 requests · network recording
E9
9 request(s) to securepubads.g.doubleclick.net
types: 6 fetch, 2 script, 1 other
GET https://securepubads.g.doubleclick.net/tag/js/gpt.js · fetch · 9 requests · network recording
E10
3 request(s) to www.googletagmanager.com
types: 3 script
GET https://www.googletagmanager.com/gtm.js · script · 3 requests · network recording
E11
1 request(s) to assets.mailerlite.com
types: 1 fetch
GET https://assets.mailerlite.com/jsonp/346184/forms/84596737602225369/track-view · fetch · network recording
E12
1 request(s) to www.clarity.ms
types: 1 script
GET https://www.clarity.ms/tag/g8l01zqksm · script · network recording
E13
2 request(s) to tracker.metricool.com
types: 1 script, 1 image
GET https://tracker.metricool.com/resources/be.js · script · 2 requests · network recording
E14
20 request(s) to platform.twitter.com
types: 17 script, 3 document
GET https://platform.twitter.com/widgets/widget_iframe.1227a5674072e080ffb1ba14ac0c1079.html · script · 20 requests · network recording
E15
1 request(s) to syndication.twitter.com
types: 1 fetch
GET https://syndication.twitter.com/settings · fetch · network recording
E16
3 request(s) to analytics.google.com
types: 3 fetch
GET https://analytics.google.com/g/collect · fetch · 3 requests · network recording
E17
2 request(s) to stats.g.doubleclick.net
types: 2 ping
GET https://stats.g.doubleclick.net/g/collect · ping · 2 requests · network recording
E18
1 request(s) to 1c032a00c5c50c5dee0a5c61f2111330.safeframe.googlesyndication.com
types: 1 document
GET https://1c032a00c5c50c5dee0a5c61f2111330.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html · document · network recording
E19
1 request(s) to scripts.clarity.ms
types: 1 script
GET https://scripts.clarity.ms/0.8.72/clarity.js · script · network recording
E20
2 request(s) to ep1.adtrafficquality.google
types: 1 xhr, 1 image
GET https://ep1.adtrafficquality.google/getconfig/sodar · xhr · 2 requests · network recording
E21
2 request(s) to c.clarity.ms
types: 2 image
GET https://c.clarity.ms/c.gif · image · 2 requests · network recording
E22
3 request(s) to f.clarity.ms
types: 3 xhr
GET https://f.clarity.ms/collect · xhr · 3 requests · network recording
E23
6 request(s) to tpc.googlesyndication.com
types: 4 script, 2 image
GET https://tpc.googlesyndication.com/pagead/js/r20261029/r20110914/abg_lite_fy2021.js · script · 6 requests · network recording
E24
11 request(s) to pagead2.googlesyndication.com
types: 7 fetch, 3 script, 1 image
GET https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js · fetch · 11 requests · network recording
E25
1 request(s) to c.bing.com
types: 1 image
GET https://c.bing.com/c.gif · image · network recording
E26
3 request(s) to ep2.adtrafficquality.google
types: 1 script, 1 document, 1 image
GET https://ep2.adtrafficquality.google/sodar/sodar2.js · script · 3 requests · network recording
E27
2 request(s) to cdn.syndication.twimg.com
types: 2 xhr
GET https://cdn.syndication.twimg.com/tweet-result · xhr · 2 requests · network recording
E28
1 request(s) to www.google.com
types: 1 document
GET https://www.google.com/recaptcha/api2/aframe · document · network recording
E29
5 request(s) to syndication.x.com
types: 5 image
GET https://syndication.x.com/i/jot/embeds · image · 5 requests · network recording
E30
6 request(s) to pbs.twimg.com
types: 6 image
GET https://pbs.twimg.com/profile_images/2077520470111551488/Shyw4Nh0_normal.jpg · image · 6 requests · network recording
E31
Cookie '_cn_user_country' set for crypto.news
kept for about 31 days
cookie _cn_user_country on crypto.news · value not stored
E32
Cookie '_cn_newsletter_popup_page_count' set for crypto.news
kept for about 7 days
cookie _cn_newsletter_popup_page_count on crypto.news · value not stored
E33
Cookie 'cf_clearance' set for crypto.news
kept for about 365 days
cookie cf_clearance on crypto.news · value not stored
E34
Cookie '_ga' set for crypto.news
kept for about 400 days
cookie _ga on crypto.news · value not stored
E35
Cookie '__cf_bm' set for twitter.com
kept for about 0 days
cookie __cf_bm on twitter.com · value not stored
E36
Cookie 'CLID' set for www.clarity.ms
kept for about 365 days
cookie CLID on www.clarity.ms · value not stored
E37
Cookie '_ga_EYKKTH3Z4Z' set for crypto.news
kept for about 400 days
cookie _ga_EYKKTH3Z4Z on crypto.news · value not stored
E38
Cookie '_clck' set for crypto.news
kept for about 365 days
cookie _clck on crypto.news · value not stored
E39
Cookie '__gads' set for crypto.news
kept for about 390 days
cookie __gads on crypto.news · value not stored
E40
Cookie '__gpi' set for crypto.news
kept for about 390 days
cookie __gpi on crypto.news · value not stored
E41
Cookie '__eoi' set for crypto.news
kept for about 180 days
cookie __eoi on crypto.news · value not stored
E42
Cookie '_ga_D9ESG7NFLS' set for crypto.news
kept for about 400 days
cookie _ga_D9ESG7NFLS on crypto.news · value not stored
E43
Cookie 'IDE' set for doubleclick.net
kept for about 400 days
cookie IDE on doubleclick.net · value not stored
E44
Cookie 'MUID' set for bing.com
kept for about 390 days
cookie MUID on bing.com · value not stored
E45
Cookie 'MR' set for c.bing.com
kept for about 7 days
cookie MR on c.bing.com · value not stored
E46
Cookie 'SRM_B' set for c.bing.com
kept for about 390 days
cookie SRM_B on c.bing.com · value not stored
E47
Cookie 'SM' set for c.clarity.ms
session cookie
cookie SM on c.clarity.ms · value not stored
E48
Cookie 'MUID' set for clarity.ms
kept for about 390 days
cookie MUID on clarity.ms · value not stored
E49
Cookie 'MR' set for c.clarity.ms
kept for about 7 days
cookie MR on c.clarity.ms · value not stored
E50
Cookie 'ANONCHK' set for c.clarity.ms
kept for about 0 days
cookie ANONCHK on c.clarity.ms · value not stored
E51
Cookie '_clsk' set for crypto.news
kept for about 1 days
cookie _clsk on crypto.news · value not stored
E52
Cookie '__cf_bm' set for x.com
kept for about 0 days
cookie __cf_bm on x.com · value not stored
E53
localStorage: 1 key(s) saved in your browser
localStorage keys: mode · values not stored
E54
sessionStorage: 2 key(s) saved in your browser
sessionStorage keys: _cn_geo_set, _cltk · values not stored
E55
Vue detected by the code reader (vue-runtime)
confidence: medium
crypto.news/app/cache/min/1/app/themes/base/js/post.js · “vue-runtime” · The code reader analyze-web-bundle 6.4.0
E56
jQuery found in the code
crypto.news/ (page HTML) @ 2207:451 · “jQuery.fn.” · pattern scan
E57
Preact found in the code
crypto.news/wp/wp-includes/js/dist/script-modules/interactivity/index.min.js @ 1:14716 · “preact” · pattern scan
E58
Google tag (gtag.js) found in the code
crypto.news/ (page HTML) @ 1:328 · “googletagmanager.com/gtag” · pattern scan
E59
Microsoft Clarity found in the code
crypto.news/ (page HTML) @ 1:153 · “clarity.ms” · pattern scan
E60
Uses the browser ability: clipboard_write
can copy text to your clipboard
crypto.news/app/themes/base/js/main.js @ 3:3618 · “clipboard.writeText(” · pattern scan
E61
Uses the browser ability: local_storage
saves small bits of data in your browser
crypto.news/app/themes/base/js/main.js @ 3:2309 · “localStorage.setItem(” · pattern scan
E62
The page called /wp-json/crypto/v1/tickers/ on crypto.news (GET)
GET https://crypto.news/wp-json/crypto/v1/tickers/ · fetch · network recording
E63
The page called /wp-json/ajax-load-more/single-posts/next-post on crypto.news (GET)
GET https://crypto.news/wp-json/ajax-load-more/single-posts/next-post · fetch · network recording
E64
The code names the endpoint /wp-json/crypto/v1/tickers
crypto.news/app/cache/min/1/app/themes/base/js/components.js @ 1:2152 · “/wp-json/crypto/v1/tickers” · pattern scan
E65
78 links to pages on the same site
page links · https://crypto.news/binance-hack-lazarus-group-north-korea/ · /binance-hack-lazarus-group-north-korea, /buy-crypto, /events, /meme-coins, /contact-us, /about, /newsletters, /advertise, /follow-up, /best-picks, /glossary, /
E66
Code reader found the route /
crypto.news/app/themes/base/js/main.js @ 3:1371 · “/” · The code reader analyze-web-bundle 6.4.0
E67
Address in code: 0x03b0ee5d82990cff1bda48651ac3e436d1a020ea
crypto.news/ (page HTML) @ 80:7546 · “0x03b0ee5d82990cff1bda48651ac3e436d1a020ea” · pattern scan
E68
The site says: “…on over 24 hours. You might also like: Elon Musk warns AI agents could exploit crypto after Binance hack READ MO…”
page text · https://crypto.news/binance-hack-lazarus-group-north-korea/ · …on over 24 hours. You might also like: Elon Musk warns AI agents could exploit crypto after Binance hack READ MO…
E69
The site says: “…billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had transferre…”
page text · https://crypto.news/binance-hack-lazarus-group-north-korea/ · …billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had transferre…
E70
The site says: “…ce hack could boost Uniswap as Standard Chartered sees DEX growth Binance hack could boost Uniswap as Standard Ch…”
page text · https://crypto.news/binance-hack-lazarus-group-north-korea/ · …ce hack could boost Uniswap as Standard Chartered sees DEX growth Binance hack could boost Uniswap as Standard Ch…
E71
The site says: “…tan said attackers moved at least $3.5 billion across four blockchains in under an hour. Investigators traced the theft to c…”
page text · https://crypto.news/binance-hack-lazarus-group-north-korea/ · …tan said attackers moved at least $3.5 billion across four blockchains in under an hour. Investigators traced the theft to c…
E72
The site says: “…o a $6.3 billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had tr…”
page text · https://crypto.news/binance-hack-lazarus-group-north-korea/ · …o a $6.3 billion breach Meanwhile, blockchain tracking platform Onchain Lens reported that the Binance attacker had tr…
E73
The Internet Archive first saved crypto.news on 2017-09-17 and has snapshots from 1004 different days
page web archive · https://web.archive.org/web/20170917190144/crypto.news

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 13 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id FFBM9gig.