To launder stolen digital assets, attackers frequently turn to nested services. These setups—encompassing over-the-counter (OTC) trading desks, smaller exchange venues, and instant swap tools—integrate with primary platforms through APIs to draw on their liquidity. When examining the public blockchain, only the central exchange addresses appear. While internal logs might show the specific intermediary involved, the true end user remains effectively masked beneath another layer of separation.
HitBTC has repeatedly surfaced in these structures, often acting as a crucial bridge for North Korean laundering operations. In the case of the $1.4B Bybit exploit, a minimum of $3.68M connected to DPRK laundering rings made its way to HitBTC. When Bybit subsequently reached out for cooperation with its inquiry, the exchange offered very little response.
This pattern aligns with broader trends. As shared in previous reporting (https://chaincatcher.com/en/article/2275277), approximately $22M in tainted capital had already moved into HitBTC by July of this year.
Now, HitBTC has appeared once more in the tracking of a high-profile theft. At 08:51 UTC on November 3, an estimated 3,600 SOL taken during the Binance hack arrived at a HitBTC @hitbtc hot wallet. The funds reached the venue after being channeled across several different pathways using automated scripts alongside a peeling-chain technique.
HitBTC has repeatedly surfaced in these structures, often acting as a crucial bridge for North Korean laundering operations. In the case of the $1.4B Bybit exploit, a minimum of $3.68M connected to DPRK laundering rings made its way to HitBTC. When Bybit subsequently reached out for cooperation with its inquiry, the exchange offered very little response.
This pattern aligns with broader trends. As shared in previous reporting (https://chaincatcher.com/en/article/2275277), approximately $22M in tainted capital had already moved into HitBTC by July of this year.
Now, HitBTC has appeared once more in the tracking of a high-profile theft. At 08:51 UTC on November 3, an estimated 3,600 SOL taken during the Binance hack arrived at a HitBTC @hitbtc hot wallet. The funds reached the venue after being channeled across several different pathways using automated scripts alongside a peeling-chain technique.
