Stolen Binance Solana Tokens Land in HitBTC Hot Wallet, Salus Says

Security firm Salus says roughly 3,600 Solana tokens tied to funds swiped from Binance landed in HitBTC's hot wallet at 3:51 a.m. ET on Nov. 3 — 08:51 UTC for the timestamp crowd. The tokens didn't take a straight line. Salus traced them through multiple routes before they pooled at the exchange's wallet.

The mechanics were anything but manual. According to Salus, automated scripts shuttled the tokens along several paths using a peeling-chain pattern — the slow-drip technique that chips off small amounts to dodge tracing. Salus says the activity points to a coordinated laundering pipeline rather than a one-off move.

This isn't HitBTC's first cameo in Salus's case files. The firm estimates about $22 million in illicit funds had already flowed into the exchange as of July, and it describes HitBTC as a key link in several investigations it has worked.

Binance isn't the only victim in the picture. Salus says at least $3.68 million connected to a North Korean laundering network flowed into HitBTC from the roughly $1.4 billion stolen from Bybit. When Bybit later asked for cooperation, Salus says the requests got almost no response.

The playbook is familiar to anyone tracking stolen crypto. Salus says hackers lean on nested services — instant-swap providers, smaller exchanges and over-the-counter desks — to break the trail into fragments that are hard to follow in one glance. Each hop adds a layer of distance between the funds and the theft.

For now, the tokens sit in HitBTC's hot wallet while Salus keeps mapping the routes. The bigger takeaway: tracing firms can follow the money, but following it and freezing it are very different problems.