Salus

This account is verified. Learn more

@salus_sec

Our research-driven approach tackles the toughest security challenges in Web3 while pioneering innovative ZK solutions.

salusec.io Joined July 2022

144 Following 11K Followers 930 Posts

Latest posts 5

Pinned post

Salus @salus_sec May 8, 2025

🛡 Salus Security is proud to continue serving as an official @BNBChain Kickstart Program Service Provider.

To further support #BNBKickstart builders, we’re offering enhanced security services:

✅ One-time FREE Smart Contract Attack Surface Review
✅ One FREE Security Advisory Session (up to 10 questions)

Security isn't optional. It’s a launch prerequisite.
Apply now → bnbchain.org/en/programs/ki…
@BNBCHAIN

Salus @salus_sec 6d

About 3,600 SOL from the Binance theft reached a HitBTC @hitbtc hot wallet at 08:51 UTC on November 3, after being routed through multiple paths using automated scripts and a peeling-chain pattern.

Once again, HitBTC has surfaced in the laundering trail of a major crypto theft.

As we previously reported, roughly $22M in illicit funds had flowed into HitBTC by July this year. chaincatcher.com/en/article/227…

In the $1.4B Bybit hack, at least $3.68M linked to North Korean money-laundering networks also reached the platform. Bybit’s subsequent requests for assistance with its investigation were met with little response.

Hackers often rely on nested services to launder stolen funds. HitBTC has featured in these arrangements across multiple cases, frequently serving as a key link in DPRK's laundering operations.

Nested services—such as instant swap providers, smaller exchanges, and OTC desks—connect to larger platforms via APIs to access their liquidity.

On-chain activity reveals only the platform’s addresses. The platform’s internal records identify the intermediary, while the actual end user remains hidden one layer deeper.

Salus @salus_sec Nov 2

🧵1/3 @MercadoBitcoin – linked hot wallets moved funds across multiple chains in ordinary signed transfers.

On Ethereum (~06:24–06:48 UTC), outflows hit the published EVM destination, then fanned into 7 onward wallets (~3.5k ETH + mixed tokens).

On Solana, Fireblocks custody made 36 sends in the same window into the published SOL destination, then 8 onward wallets.

Funds are already fragmenting past the first hop.

Salus @salus_sec Oct 28

The CryptoBilis exploiter deposited another 1,200 ETH (~$2.78M) into Tornado Cash on October 27, 18 days after the mass wallet theft.

Ledger @Ledger confirmed an unauthorized hardware implant in one victim’s device on October 11.
x.com/Ledger_Support…

The attacker used 0x468b…2a4e, a wallet that had received funds on October 9, to send 600.1 ETH each to two fresh wallets.

Minutes later, the two wallets began depositing in parallel. Between 14:24:59 and 14:27:23 UTC, each made six deposits of 100 ETH — 12 deposits in total.

The October 9 theft affected users who bought Ledger devices through Southeast Asian reseller CryptoBilis.

Bitquery estimates losses at ~$102M across multiple chains.

Ledger Support Verified account @Ledger_Support Oct 10

Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: bounty@ledger.fr. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.

Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).

Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.

Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase.

For assistance or questions, contact Ledger customer support through our official channels: support.ledger.com
View quoted post on X

Salus @salus_sec Oct 25

Tether has blacklisted 9 addresses linked to the @CoinDCX incident, freezing 2,212,850.30 USDT. The freeze took effect on October 22, 2026 at 22:45:39 UTC.

The trail began when our investigator @DarcyAri flagged an unusual transfer of roughly 15.99M USDT and kept tracking how the funds were split and sent to exchange deposit addresses.
Original post: x.com/DarcyAri/statu…

@smtgpt initially said no breach had occurred. We then raised questions based on the PoR address transfers and TRX distribution patterns, which drew responses from the parties involved and gave Tether verifiable on-chain evidence to act on.

Salus will keep supporting the investigation and recovery work.

Darcy 链上调查⛑️ Verified account @DarcyAri Oct 22

10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX

CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX

其中最大单笔为 15,819,002 USDT，该地址随后向多个地址转出资金，经多次拆分流向Binance、OKX、Gate 等充值地址
View quoted post on X