Cryptocurrency laundering networks frequently take advantage of nested services to obscure stolen capital, and HitBTC has repeatedly appeared as a critical conduit in these operations, particularly for groups tied to North Korea.
To help understand the mechanics, nested entities such as over-the-counter desks, instant swap platforms, and minor exchanges tap into major exchange liquidity pools through APIs. While public blockchain records display solely the primary exchange addresses, internal logs document only the broker, effectively shielding the true depositor beneath an additional layer of anonymity.
This pattern has placed HitBTC in the spotlight across multiple major security incidents. Following the historic 1.4B dollar Bybit breach, a minimum of 3.68M dollars connected to North Korean illicit financial rings was directed onto the exchange. When Bybit reached out to request cooperation for its inquiries, the outreach was met with scarcely any feedback. Furthermore, our earlier reporting highlighted that around 22M dollars in suspicious deposits had reached HitBTC by July of this year (https://www.chaincatcher.com/en/article/2275277).
In the latest development, HitBTC has once again entered the laundering path of a prominent crypto incident. At 08:51 UTC on November 3, an inflow of 3,600 SOL originating from the Binance theft settled into a HitBTC @hitbtc hot wallet. The perpetrators moved these funds across various routes with the aid of automated scripts and a peeling-chain strategy.
To help understand the mechanics, nested entities such as over-the-counter desks, instant swap platforms, and minor exchanges tap into major exchange liquidity pools through APIs. While public blockchain records display solely the primary exchange addresses, internal logs document only the broker, effectively shielding the true depositor beneath an additional layer of anonymity.
This pattern has placed HitBTC in the spotlight across multiple major security incidents. Following the historic 1.4B dollar Bybit breach, a minimum of 3.68M dollars connected to North Korean illicit financial rings was directed onto the exchange. When Bybit reached out to request cooperation for its inquiries, the outreach was met with scarcely any feedback. Furthermore, our earlier reporting highlighted that around 22M dollars in suspicious deposits had reached HitBTC by July of this year (https://www.chaincatcher.com/en/article/2275277).
In the latest development, HitBTC has once again entered the laundering path of a prominent crypto incident. At 08:51 UTC on November 3, an inflow of 3,600 SOL originating from the Binance theft settled into a HitBTC @hitbtc hot wallet. The perpetrators moved these funds across various routes with the aid of automated scripts and a peeling-chain strategy.

