Salus

🛡 Salus Security is proud to continue serving as an official @BNBChain Kickstart Program Service Provider. To further support #BNBKickstart builders, we’re offering enhanced security services: ✅ One-time FREE Smart Contract Attack Surface Review ✅ One FREE Security Advisory Session (up to 10 questions) Security isn't optional. It’s a launch prerequisite. Apply now → bnbchain.org/en/programs/kic… @BNBCHAIN

Security incidents keep piling up. Salus is opening 10 free security checkup slots for Web3 projects. You don't need to hand over much: • Pentest: no core source code, no internal network access. We work black-box from your external surface. • Smart contract review: just the target code. 🚨 A real case from one of our past pentests (shared with the client's permission): A project's dashboard subdomain still pointed to a hosting address nobody owned. We claimed it, and the project's own domain started serving our test page. No source code, no internal access. Just one forgotten DNS record. -- How to participate 👇 1) Apply: DM our BD on X and we'll send you a short form 2) Materials & authorization: Confirm scope (domains / contract code) and approve non-destructive testing 3) Testing & assessment: Pentest of your external surface and/or contract review Delivery: A concise findings list with hardening suggestions DM @DarcyAri or @Jack24klove to apply.

About 3,600 SOL from the Binance theft reached a HitBTC @hitbtc hot wallet at 08:51 UTC on November 3, after being routed through multiple paths using automated scripts and a peeling-chain pattern. Once again, HitBTC has surfaced in the laundering trail of a major crypto theft. As we previously reported, roughly $22M in illicit funds had flowed into HitBTC by July this year. chaincatcher.com/en/article/… In the $1.4B Bybit hack, at least $3.68M linked to North Korean money-laundering networks also reached the platform. Bybit’s subsequent requests for assistance with its investigation were met with little response. Hackers often rely on nested services to launder stolen funds. HitBTC has featured in these arrangements across multiple cases, frequently serving as a key link in DPRK's laundering operations. Nested services—such as instant swap providers, smaller exchanges, and OTC desks—connect to larger platforms via APIs to access their liquidity. On-chain activity reveals only the platform’s addresses. The platform’s internal records identify the intermediary, while the actual end user remains hidden one layer deeper.

The CryptoBilis exploiter deposited another 1,200 ETH (~$2.78M) into Tornado Cash on October 27, 18 days after the mass wallet theft. Ledger @Ledger confirmed an unauthorized hardware implant in one victim’s device on October 11. xitter.cf/Ledger_Support/status/… The attacker used 0x468b…2a4e, a wallet that had received funds on October 9, to send 600.1 ETH each to two fresh wallets. Minutes later, the two wallets began depositing in parallel. Between 14:24:59 and 14:27:23 UTC, each made six deposits of 100 ETH — 12 deposits in total. The October 9 theft affected users who bought Ledger devices through Southeast Asian reseller CryptoBilis. Bitquery estimates losses at ~$102M across multiple chains.

Tether has blacklisted 9 addresses linked to the @CoinDCX incident, freezing 2,212,850.30 USDT. The freeze took effect on October 22, 2026 at 22:45:39 UTC. The trail began when our investigator @DarcyAri flagged an unusual transfer of roughly 15.99M USDT and kept tracking how the funds were split and sent to exchange deposit addresses. Original post: xitter.cf/DarcyAri/status/211314… @smtgpt initially said no breach had occurred. We then raised questions based on the PoR address transfers and TRX distribution patterns, which drew responses from the parties involved and gave Tether verifiable on-chain evidence to act on. Salus will keep supporting the investigation and recovery work.

We detected new activity from a wallet linked in 2025 reporting to scams targeting @coinbase users. 0xc84c…ab84 sent 3M sUSDS to a fresh wallet. After conversion, 36 Tornado Cash deposits followed, totaling 1,389.6 ETH. Background: theblock.co/news/regulation/…

The Drift Protocol exploiter has begun moving funds from another long-dormant wallet, depositing 4,600 ETH (~$11.23M) into Tornado Cash on October 21, 2026. The two wallets we have tracked have now deposited a combined 30,310 ETH. Following the 19,600 ETH in our previous update, 0xaa843e…57c1 deposited a further 6,110 ETH, bringing that wallet’s total to 25,710 ETH. At 06:55:47 UTC today, it forwarded 3.9773 ETH to 0xd3feed…f6c7. Less than five minutes later, the receiving wallet began its first outgoing transfers after roughly 202 days. It had accumulated 24,881.97 ETH from 11 wallets on April 1, with its main funding route traced to USDC bridged from Solana via CCTP and converted to ETH. Between 07:00:35 and 07:19:23 UTC, it made 46 deposits of 100 ETH. At that cutoff, 20,285.82 ETH remained in the wallet.

The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system. On April 1, the Solana perpetuals platform suffered an estimated $285M theft following social engineering and an administrative takeover, according to Chainalysis. The exploiter bridged part of the funds to Ethereum via CCTP, converted them into ETH and parked them in 0xaa843e…57c1. That wallet made its first outgoing transaction today. As of October 20, the wallet still held approximately 6,114.15 ETH (~$14.60M).

On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another party Realizing something was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement

Salus has completed a penetration test for Tapuot We assessed the agreed scope from an attacker’s perspective and delivered our findings and remediation recommendations to the team Thanks to Tapuot for investing in independent security testing @Blonskr

According to our Tornado monitoring system, the Triple-A @TripleAHQ attacker moved 4,970 ETH, worth approximately $12.4 million, into Tornado Cash. In July, the attacker stole assets from payment provider Triple-A’s own treasury, with publicly estimated losses of approximately $11.8 million. After bridging the funds to Ethereum and swapping assets, the attacker split the funds between two intermediary addresses on September 6. On October 9, the attacker routed both streams through a single wallet and deposited them into Tornado Cash in 49 transactions of 100 ETH and seven transactions of 10 ETH. One stream included funds from earlier mixer withdrawals.

🚨@RevenueFamily involves malicious approvals. The perpetrators submit users’ permit signatures to obtain unlimited permission to spend their USDG, then immediately call transferFrom. The approval and fund transfer are completed in the same transaction, draining users’ wallets The funds are then split 20%/80% between two hacker addresses. This distribution structure resembles Inferno’s drainer-as-a-service model, and its promotional approach matches FomoPeek’s model of using KOLs to carry out scams

We have conducted comprehensive tracing and forensic analysis of the funds stolen from @bitget . The funds are currently held at the addresses listed below, although some remain in motion. Based on our previous experience responding to incidents involving North Korean threat actors, tracing and freezing these assets is likely to be highly challenging. We recommend that Bitget adopt a white-hat bounty program similar to @Bybit_Official ’s model, incentivizing more leading security firms and independent researchers to continue monitoring and tracing the stolen funds. ETH： 0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899 0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2 0xDc2901f741B4003e32B8B752e97b8c4C1891dC63 0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0 0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272 0xFd5EBe912e2061992437767e24e5BCb52a3f9e54 0xeD5a394a7558929112848B7e97B569de6bbE1A51 0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284 0xe07bd590e1198666230932bad5db3dbbe21e7d57 USDT / USDC： 0xe07bd590e1198666230932bad5db3dbbe21e7d57 BNB： 0x150889FE4fA7a7699588f75C4189FA9e721acFD3 0x3a82a441f1e75d2022d17f6b082979c04fd67652 0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7 0x2399548147f367375b798256cc620cf2dbac7f10 BTC： 13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T XRP： rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7 rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z RLUSD： rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD TRX： TBWNguTTgezw9dVorX441C6nDrZpRxYwKD @GracyBitget @xiejiayinBitget

802.5 ETH entered Tornado Cash through 0x29352a44cf77f276a52c1275c564a7530ba34c55 between 19:32 and 19:51 UTC on Sep 23, 2026. Cross-chain reconstruction and fund tracing identified links between upstream addresses and Huione, Xinbi, and a cluster of sanctioned addresses.

Salus has completed a smart contract security audit of @KeyFlow_EN’s KEYFlexibleStake Developed by the KeyFlow team and deployed on @BNBCHAIN, the contract supports multiple asset configurations to provide users with a more flexible on-chain staking and asset management experience The audit focused on signature verification, access control, core business logic, and critical execution paths—helping the team identify potential risks and further strengthen the contract’s security and reliability No high- or medium-severity issues were identified within the audited scope Read the full audit report: github.com/Salusec/Salus-aud…

We’re hiring a part-time Channel Business Development professional to join our Partnerships & Business Development team! Salus specializes in smart contract audits, Web3 penetration testing, and asset recovery services, providing professional security support for Web3 projects. Our security track record: 🟠 300+ Projects served and protected 🔴 0 REKT Publicly disclosed security record of protected projects 🟠 100% Project security rate disclosed on our official website 🔴 100% Penetration testing success rate disclosed on our official website You’ll work with us to: • Support high-quality Web3 projects with security needs • Develop partnership channels through communities and ecosystem partners • Follow up with prospective clients and partnership opportunities • Help build stable, long-term ecosystem partnerships Experience in business development, channel partnerships, or community operations is a plus. Part-time · Fully remote Industry-competitive compensation and incentives Send your CV or a brief introduction to hr@salusec.io. For the fastest response, you can also DM @Jack24klove or @DarcyAri directly. Email subject: Part-time Channel BD Know someone who might be a great fit? Feel free to share this opportunity or refer them to us!