The security agency Salus has once again brought a fund trail that originally only existed in blockchain data into the spotlight—according to its on-chain monitoring results disclosed on platform X, about 3600 SOL from the previously stolen assets related to Binance were not simply transferred from address A to address B; instead, they were split into countless fragments under the control of automated scripts, attempting to dilute the original source through a "stripping chain" model, with multi-path and multi-hop transfers on-chain, using a large amount of small, forked transfer records. Following this deliberately muddled path, Salus stated that it could still see the 3600 SOL being re-aggregated to the same destination—HitBTC's hot wallet address at 16:51 Beijing time on November 3. Before this, Salus had previously reported about 22 million dollars of illegal fund inflow as of July, which also pointed towards this trading platform multiple times. All current conclusions are derived solely from the on-chain analysis of a third-party security team, and neither Binance nor HitBTC has publicly responded. However, when a centralized custodial platform repeatedly appears at the endpoint of major thefts, the question of how HitBTC balances anti-money laundering with business growth is being placed at the forefront of compliance dilemmas.

Script Bombing and Stripping Chain: The Dissection of Stolen SOL

In Salus's review, this batch of about 3600 SOL did not simply "run directly from point A to point B," but was first bombarded by scripts to be broken apart. Automated scripts continuously initiated multiple transfer instructions from the same source address, cutting the originally large chips into dozens or even more tiny fragments, while redirecting them across multiple paths. Along each path, the scripts continually "relay" according to predetermined logic: one transaction splits into multiple transactions, the previous hop just confirmed, and the next hop broadcasts immediately. Within minutes, a dense transfer network can be formed on-chain.

This model is referred to as a "stripping chain" in traditional on-chain analysis contexts—through a large number of small, multi-hop transfers, funds are peeled away layer by layer from the original source. For on-chain auditing, what was originally required to focus on a thick line now needs to handle far more than the usual transaction volume and path nodes in the graph; not only must the time order of each hop be restored, but it must also be judged which branches will re-converge later. Salus pointed out that the approximately 3600 SOL in this case is a typical "first consolidate, then disperse, and then recover" path: split into multiple stripping chains from a single source by scripts, subjected to multiple rounds of small transfers on the public blockchain, before gradually being collected back to a few aggregation addresses from various side routes. Theoretically, each step could be audited, but with costs amplified exponentially, the participants who can trace to the endpoint will inevitably be very limited.

HitBTC Named Again: The Hacker's Preferred Endpoint

Following these constantly stripped and forked funding chains, Salus provided a very specific answer: at 16:51 Beijing time on November 3, the approximately 3600 SOL marked as related to the Binance theft incident eventually flowed into the same collection point—HitBTC's hot wallet address. In other words, after the script-controlled multi-path splitting, the hot wallet of this centralized exchange became the "final stop" of the on-chain fund trail. It is worth emphasizing that this conclusion comes entirely from the monitoring of a third-party security agency, and as of now, neither Binance nor HitBTC has publicly confirmed or provided differing accounts on-chain.

For HitBTC, this is not the first time it has appeared at the end of such stories. Salus previously reported that as of July, approximately 22 million dollars identified as illegal funds had flowed into HitBTC, and the same trading platform can be seen in the on-chain paths of multiple major theft incidents. It is this "multiple cases, same endpoint" repeated pattern that has led outsiders to shift their focus from individual incidents to overall compliance practices: when a centralized exchange is repeatedly indicated as a gathering outlet for suspicious funds, the industry will naturally question whether its KYC, address blacklists, and suspicious deposit reviews are genuinely implemented. Moreover, after the exposure of this case, no freezes or explanations regarding relevant funds have been seen, further amplifying doubts regarding its attitude toward risk control and execution capability.

Public Tracking by Security Agencies: On-chain Intelligence Pressuring Exchanges

While doubts about HitBTC's risk control attitude grow in the public eye, security agencies like Salus are shining light on another dimension. In this incident, it was Salus that organized the multi-path transfer process of the approximately 3600 SOL related to the Binance theft through on-chain monitoring and publicly concluded on platform X that "stripping chain money laundering ends in HitBTC's hot wallet." For a centralized exchange that has been named, this kind of public on-chain intelligence is not equivalent to an enforcement order, but will quickly ferment into public opinion pressure within the industry and among users: when "a certain address, a certain time point, a certain hot wallet" is clearly documented, if the exchange chooses silence, it effectively uses its brand to underwrite the narrative on this chain.

However, it is necessary to also delineate its boundaries. Salus's reconstruction of the 3600 SOL funding path, as well as its previous claim that "approximately 22 million dollars of illegal funds flowed into HitBTC as of July, and HitBTC appears in the paths of multiple major theft cases," are still only coming from a single third-party source, and no confirmation or denial regarding related fund inflows from Binance or HitBTC has been seen, nor have regulatory agencies publicly disclosed intervention details. In recent years, several incidents of stolen crypto assets have seen similar third-party tracking and public "naming"; however, from on-chain intelligence to regulatory and judicial actions, there remains a significant gap that needs to be filled by higher evidentiary thresholds and procedural justice. Readers referencing these conclusions must always be aware that the credibility of the information and the scope of responsibility are not equivalent to official classifications.

Hidden Risks Ordinary Users Face Through Exchange Entry Points

When a certain exchange is repeatedly mentioned alongside "suspicious funds" by security agencies, the compliance uncertainties often burden not just the platform itself. Taking this case as an example, according to Salus's single source, HitBTC has appeared multiple times in the funding paths of major theft cases and has reported that approximately 22 million dollars had been classified as illegal funds inflowing into the platform as of July. Even if these statements have yet to receive official confirmation, this ongoing negative label itself could categorize some entry points as "subjects requiring closer scrutiny" from a regulatory perspective.

In traditional finance, some judicial jurisdictions have initiated investigations or taken restrictive measures against institutions that have long accepted a large amount of suspicious funds. This precedent suggests that once a centralized exchange is scrutinized or even sanctioned due to similar doubts, the user assets under its custodianship are likely to first encounter risks such as withdrawal delays, tightened limits, and restricted account access. In the case of the approximately 3600 SOL incident, there is currently no evidence that ordinary user accounts at HitBTC have been directly affected, but the controversy surrounding whether it sufficiently screens on-chain suspicious funds objectively intensifies market concerns about its compliance. For ordinary investors, choosing an exchange is not just about trading experience and fees; it should also consider historical controversy records, attitudes towards suspicious deposits, and whether it actively cooperates with on-chain address marking, blacklists, and other compliance tools. These dimensions ultimately return to one question: in extreme circumstances, can you smoothly reclaim your assets when needed.

Regulation and Public Chain Game Under Upgraded Money Laundering Techniques

The transfer path of the approximately 3600 SOL reveals a clear trend: the combination of automated scripts, multi-path diversion, and stripping chains is upgrading the traditional coarse techniques of "change the address after one transfer" to a high-frequency, finely granular on-chain maze. HitBTC, which Salus previously reported as receiving about 22 million dollars identified as illegal funds and appearing multiple times in major theft paths, has now been designated as a gathering endpoint by a single source, amplifying the position of centralized exchanges within the money laundering chain more than ever. Correspondingly, security agencies represented by Salus are leveraging on-chain transparency for public tracking and disclosing details on platforms like X, this route of "public evidence gathering—public opinion pressure" is becoming an important supplement to balance the blind spots in exchange risk control. Looking ahead, on-chain address marking, cross-platform blacklist sharing, and stricter deposit scrutiny are likely to be further incorporated into industry compliance frameworks, imposing more operable requirements on exchanges concerning the identification and handling of suspicious funds. In this event, three subsequent observation points worth monitoring are: whether related addresses will be officially marked by more institutions or platforms, whether Binance and HitBTC will ultimately provide public responses, and whether this individual case will ignite a new round of collective discussions within the industry on "how to handle suspicious on-chain funds." These three variables will determine whether this 3600 SOL incident will be written into the history of industry compliance evolution.

Join our community to discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。