Salus Tracks 3,600 Solana Tokens From Binance Theft to HitBTC

Security firm Salus said about 3,600 Solana (SOL) tokens tied to funds stolen from Binance reached HitBTC’s hot wallet at 3:51 a.m. ET on Nov. 3 (08:51 UTC), in a transfer it traced through multiple paths.

Salus said automated scripts moved the tokens along several routes using a peeling-chain pattern. The firm estimated that about $22 million in illicit funds had flowed into HitBTC as of July. TokenPost previously covered fund tracing tied to the Binance theft.

In a separate case involving about $1.4 billion stolen from Bybit, Salus said at least $3.68 million linked to a North Korean laundering network flowed into HitBTC. Salus said Bybit’s later requests for cooperation received almost no response.

Salus said hackers often use nested services such as instant-swap providers, smaller exchanges and over-the-counter desks to move funds. The firm described HitBTC as a key link in several cases.