Binance hot wallet theft (~$6.3B): losses covered, withdrawals resuming in phases
https://sockanalyst.com/patch-now/binance-hot-wallet-theft-recovery

Splunk
index=proxy OR index=dns (query="*binance*" OR dest="*binance*" OR url="*binance*")
NOT (query="*.binance.com" OR query="binance.com" OR dest="*.binance.com")
| stats count dc(src_ip) as clients by query, dest
| sort - count

Sentinel
union isfuzzy=true
 (DnsEvents | where Name has "binance" and not(Name endswith "binance.com") | project TimeGenerated, Computer, Name, ClientIP),
 (EmailUrlInfo | where Url has "binance" and not(UrlDomain endswith "binance.com") | project TimeGenerated, Url, UrlDomain, NetworkMessageId)
| summarize count() by Name, Url, UrlDomain