Pinned Tweet
🛡 Salus Security is proud to continue serving as an official @BNBChain Kickstart Program Service Provider.
To further support #BNBKickstart builders, we’re offering enhanced security services:
✅ One-time FREE Smart Contract Attack Surface Review
✅ One FREE Security Advisory ions)
Security isn't optional. It’s a launch prerequisite.
Apply now → bnbchain.org/en/programs/ki…
@BNBCHAIN
To further support #BNBKickstart builders, we’re offering enhanced security services:
✅ One-time FREE Smart Contract Attack Surface Review
✅ One FREE Security Advisory ions)
Security isn't optional. It’s a launch prerequisite.
Apply now → bnbchain.org/en/programs/ki…
@BNBCHAIN
4
0
15
12,490
Security incidents keep piling up.
Salus is opening 10 free security checkup slots for Web3 projects.
You don't need to hand over much:
• Pentest: no core source code, no internal network access. We work black-box from your external surface.
• Smart contract review: just the case from one of our past pentests (shared with the client's permission):
A project's dashboard subdomain still pointed to a hosting address nobody owned.
We claimed it, and the project's own domain started serving our test page.
No source code, no internal access. Just one forgotten DNS record.
--
How to participate 👇
1) Apply:
DM our BD on X and we'll send you a short form
2) Materials & authorization:
Confirm scope (domains / contract code) and approve non-destructive testing
3) Testing & assessment:
Pentest of your external surface and/or contract review
Delivery:
A concise findings list with hardening suggestions
DM @DarcyAri or @Jack24klove to apply.
Salus is opening 10 free security checkup slots for Web3 projects.
You don't need to hand over much:
• Pentest: no core source code, no internal network access. We work black-box from your external surface.
• Smart contract review: just the case from one of our past pentests (shared with the client's permission):
A project's dashboard subdomain still pointed to a hosting address nobody owned.
We claimed it, and the project's own domain started serving our test page.
No source code, no internal access. Just one forgotten DNS record.
--
How to participate 👇
1) Apply:
DM our BD on X and we'll send you a short form
2) Materials & authorization:
Confirm scope (domains / contract code) and approve non-destructive testing
3) Testing & assessment:
Pentest of your external surface and/or contract review
Delivery:
A concise findings list with hardening suggestions
DM @DarcyAri or @Jack24klove to apply.
0
1
5
1,045
About 3,600 SOL from the Binance theft reached a HitBTC @hitbtc hot wallet at 08:51 UTC on November 3, after being routed through multiple paths using automated scripts and a peeling-chain pattern.
Once again, HitBTC has surfaced in the laundering trail of a major crypto sly reported, roughly $22M in illicit funds had flowed into HitBTC by July this year. chaincatcher.com/en/article/227…
In the $1.4B Bybit hack, at least $3.68M linked to North Korean money-laundering networks also reached the platform. Bybit’s subsequent requests for assistance with its investigation were met with little response.
Hackers often rely on nested services to launder stolen funds. HitBTC has featured in these arrangements across multiple cases, frequently serving as a key link in DPRK's laundering operations.
Nested services—such as instant swap providers, smaller exchanges, and OTC desks—connect to larger platforms via APIs to access their liquidity.
On-chain activity reveals only the platform’s addresses. The platform’s internal records identify the intermediary, while the actual end user remains hidden one layer deeper.
Once again, HitBTC has surfaced in the laundering trail of a major crypto sly reported, roughly $22M in illicit funds had flowed into HitBTC by July this year. chaincatcher.com/en/article/227…
In the $1.4B Bybit hack, at least $3.68M linked to North Korean money-laundering networks also reached the platform. Bybit’s subsequent requests for assistance with its investigation were met with little response.
Hackers often rely on nested services to launder stolen funds. HitBTC has featured in these arrangements across multiple cases, frequently serving as a key link in DPRK's laundering operations.
Nested services—such as instant swap providers, smaller exchanges, and OTC desks—connect to larger platforms via APIs to access their liquidity.
On-chain activity reveals only the platform’s addresses. The platform’s internal records identify the intermediary, while the actual end user remains hidden one layer deeper.
1
0
4
803
🧵1/3 @MercadoBitcoin – linked hot wallets moved funds across multiple chains in ordinary signed transfers.
On Ethereum (~06:24–06:48 UTC), outflows hit the published EVM destination, then fanned into 7 onward wallets (~3.5k ETH + mixed tokens).
On Solana, Fireblocks custody me window into the published SOL destination, then 8 onward wallets.
Funds are already fragmenting past the first hop.
On Ethereum (~06:24–06:48 UTC), outflows hit the published EVM destination, then fanned into 7 onward wallets (~3.5k ETH + mixed tokens).
On Solana, Fireblocks custody me window into the published SOL destination, then 8 onward wallets.
Funds are already fragmenting past the first hop.
1
1
4
318
2/3 The same EVM collector also pulled Polygon, Arbitrum, and BNB flows—no bridge inferred in our graph.
TRON shows the freeze race in one path: ~708k USDT frozen ~11:37 UTC at the published TRON destination, while ~1.7M TRX still moved onward.
Different slices are not pace.
TRON shows the freeze race in one path: ~708k USDT frozen ~11:37 UTC at the published TRON destination, while ~1.7M TRX still moved onward.
Different slices are not pace.
1
0
0
106
3/3 On Bitcoin, multiple UTXO inputs consolidated into the reported BTC recipient: ≈106.07 BTC, unspent when queried.
OTCs and exchanges: screen the published destinations and first-hop recipients now.
Immediate window is issuer freezes and deposit screening.
OTCs and exchanges: screen the published destinations and first-hop recipients now.
Immediate window is issuer freezes and deposit screening.
0
0
0
43
The CryptoBilis exploiter deposited another 1,200 ETH (~$2.78M) into Tornado Cash on October 27, 18 days after the mass wallet theft.
Ledger @Ledger confirmed an unauthorized hardware implant in one victim’s device on October 11.
x.com/Ledger_Support…
The attacker used hat had received funds on October 9, to send 600.1 ETH each to two fresh wallets.
Minutes later, the two wallets began depositing in parallel. Between 14:24:59 and 14:27:23 UTC, each made six deposits of 100 ETH — 12 deposits in total.
The October 9 theft affected users who bought Ledger devices through Southeast Asian reseller CryptoBilis.
Bitquery estimates losses at ~$102M across multiple chains.
Ledger @Ledger confirmed an unauthorized hardware implant in one victim’s device on October 11.
x.com/Ledger_Support…
The attacker used hat had received funds on October 9, to send 600.1 ETH each to two fresh wallets.
Minutes later, the two wallets began depositing in parallel. Between 14:24:59 and 14:27:23 UTC, each made six deposits of 100 ETH — 12 deposits in total.
The October 9 theft affected users who bought Ledger devices through Southeast Asian reseller CryptoBilis.
Bitquery estimates losses at ~$102M across multiple chains.
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: bounty@ledger.fr. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.
Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).
Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions.
Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase.
For assistance or questions, contact Ledger customer support through our official channels: support.ledger.com
1
0
4
475
Tether has blacklisted 9 addresses linked to the @CoinDCX incident, freezing 2,212,850.30 USDT. The freeze took effect on October 22, 2026 at 22:45:39 UTC.
The trail began when our investigator @DarcyAri flagged an unusual transfer of roughly 15.99M USDT and kept tracking how d sent to exchange deposit addresses.
Original post: x.com/DarcyAri/statu…
@smtgpt initially said no breach had occurred. We then raised questions based on the PoR address transfers and TRX distribution patterns, which drew responses from the parties involved and gave Tether verifiable on-chain evidence to act on.
Salus will keep supporting the investigation and recovery work.
The trail began when our investigator @DarcyAri flagged an unusual transfer of roughly 15.99M USDT and kept tracking how d sent to exchange deposit addresses.
Original post: x.com/DarcyAri/statu…
@smtgpt initially said no breach had occurred. We then raised questions based on the PoR address transfers and TRX distribution patterns, which drew responses from the parties involved and gave Tether verifiable on-chain evidence to act on.
Salus will keep supporting the investigation and recovery work.
10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX
CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX
其中最大单笔为 15,819,002 USDT，该地址随后向多个地址转出资金，经多次拆分流向Binance、OKX、Gate 等充值地址
0
1
7
42,181
We detected new activity from a wallet linked in 2025 reporting to scams targeting @coinbase users.
0xc84c…ab84 sent 3M sUSDS to a fresh wallet. After conversion, 36 Tornado Cash deposits followed, totaling 1,389.6 ETH.
Background:
theblock.co/news/regulatio…
0xc84c…ab84 sent 3M sUSDS to a fresh wallet. After conversion, 36 Tornado Cash deposits followed, totaling 1,389.6 ETH.
Background:
theblock.co/news/regulatio…
1
0
3
450
The Drift Protocol exploiter has begun moving funds from another long-dormant wallet, depositing 4,600 ETH (~$11.23M) into Tornado Cash on October 21, 2026. The two wallets we have tracked have now deposited a combined 30,310 ETH.
Following the 19,600 ETH in our previous update, a further 6,110 ETH, bringing that wallet’s total to 25,710 ETH. At 06:55:47 UTC today, it forwarded 3.9773 ETH to 0xd3feed…f6c7.
Less than five minutes later, the receiving wallet began its first outgoing transfers after roughly 202 days. It had accumulated 24,881.97 ETH from 11 wallets on April 1, with its main funding route traced to USDC bridged from Solana via CCTP and converted to ETH.
Between 07:00:35 and 07:19:23 UTC, it made 46 deposits of 100 ETH. At that cutoff, 20,285.82 ETH remained in the wallet.
Following the 19,600 ETH in our previous update, a further 6,110 ETH, bringing that wallet’s total to 25,710 ETH. At 06:55:47 UTC today, it forwarded 3.9773 ETH to 0xd3feed…f6c7.
Less than five minutes later, the receiving wallet began its first outgoing transfers after roughly 202 days. It had accumulated 24,881.97 ETH from 11 wallets on April 1, with its main funding route traced to USDC bridged from Solana via CCTP and converted to ETH.
Between 07:00:35 and 07:19:23 UTC, it made 46 deposits of 100 ETH. At that cutoff, 20,285.82 ETH remained in the wallet.
The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.
On April 1, the Solana perpetuals platform suffered an estimated $285M engineering and an administrative takeover, according to Chainalysis.
The exploiter bridged part of the funds to Ethereum via CCTP, converted them into ETH and parked them in 0xaa843e…57c1. That wallet made its first outgoing transaction today.
As of October 20, the wallet still held approximately 6,114.15 ETH (~$14.60M).
4
0
5
2,932
The Drift Protocol exploiter deposited 19,600 ETH (~$46.81M) into Tornado Cash in 196 transactions on October 20, 2026, moving funds held for roughly 202 days, according to the our Tornado monitoring system.
On April 1, the Solana perpetuals platform suffered an estimated $285M engineering and an administrative takeover, according to Chainalysis.
The exploiter bridged part of the funds to Ethereum via CCTP, converted them into ETH and parked them in 0xaa843e…57c1. That wallet made its first outgoing transaction today.
As of October 20, the wallet still held approximately 6,114.15 ETH (~$14.60M).
On April 1, the Solana perpetuals platform suffered an estimated $285M engineering and an administrative takeover, according to Chainalysis.
The exploiter bridged part of the funds to Ethereum via CCTP, converted them into ETH and parked them in 0xaa843e…57c1. That wallet made its first outgoing transaction today.
As of October 20, the wallet still held approximately 6,114.15 ETH (~$14.60M).
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.
This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.
0
2
7
36,621
According to our Tornado monitoring system, the Aztec Connect exploiter deposited 1,255.8 ETH (~$3.01M) into Tornado Cash in 30 transactions on October 19, 2026.
On June 14, the attacker exploited a settlement-validation flaw in the deprecated Aztec Connect contracts, stealing approximately $2.19M in assets, including 908.987 ETH, DAI, wstETH and Yearn vault tokens.
After holding the assets for roughly four months, the attacker redeemed the vault tokens and converted the token holdings into an additional 346.767 ETH on October 19.
The proceeds and existing ETH were then deposited in batches: 12×100, 5×10, 5×1 and 8×0.1 ETH.
All six stolen ERC-20 balances are now zero.
On June 14, the attacker exploited a settlement-validation flaw in the deprecated Aztec Connect contracts, stealing approximately $2.19M in assets, including 908.987 ETH, DAI, wstETH and Yearn vault tokens.
After holding the assets for roughly four months, the attacker redeemed the vault tokens and converted the token holdings into an additional 346.767 ETH on October 19.
The proceeds and existing ETH were then deposited in batches: 12×100, 5×10, 5×1 and 8×0.1 ETH.
All six stolen ERC-20 balances are now zero.
We are investigating a potential exploit affecting Aztec Connect. ~$2.1m was transferred from the immutable smart contract in transaction:
etherscan.io/tx/0x074ec9317…
Aztec Connect was deprecated 3 years ago. Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us.
We will share further updates in due course.
3
1
7
34,657
On October 11, a content creator received a lucrative offer for a commercial shoot. The organizers paid a deposit upfront to gain their trust, then lured them to Thailand. Upon arrival, the victim was taken to an isolated house, where they faced the risk of being sold to another ing was wrong, the victim contacted family and friends and feigned illness to buy time. According to the victim, the prospective buyers disputed the agreed price because of their apparent illness. An argument broke out, temporarily halting the transaction and buying crucial time for rescue. After receiving a request for help from the victim’s family and friends, we worked with police to pinpoint their location using phone-related leads concerning those involved, photographs the victim had taken along the journey, and a photograph of a food delivery order. We ultimately helped secure the victim’s rescue
Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing
The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement
Police subsequently took those involved in for questioning and continued examining their immigration records, travel in border areas, and possible involvement in irregular border crossings. The investigation remains ongoing
The window for intervention before victims are transferred across the Thai–Myanmar border is extremely narrow. Once they have been taken across, rescue becomes very difficult. Even when an overseas job offer includes an upfront deposit, verify the employer, the actual work location, and the people arranging the engagement
1
0
12
11,776
Salus has completed a penetration test for Tapuot
We assessed the agreed scope from an attacker’s perspective and delivered our findings and remediation recommendations to the team
Thanks to Tapuot for investing in independent security testing @Blonskr
We assessed the agreed scope from an attacker’s perspective and delivered our findings and remediation recommendations to the team
Thanks to Tapuot for investing in independent security testing @Blonskr
Salus has completed a smart contract security audit of TapeOut Protocol, created by @Blonskr.
Built on @BNBCHAIN, TapeOut Protocol enables users to design circuits using NAND and LATCH components and publish completed circuits on-chain.
The audit focused on the in-scope core execution paths, helping the team identify potential risks and further strengthen the protocol’s security and reliability.
Read the full audit report ：
github.com/Salusec/Salus-…
0
0
23
3,861
According to our Tornado monitoring system, the Triple-A @TripleAHQ attacker moved 4,970 ETH, worth approximately $12.4 million, into Tornado Cash.
In July, the attacker stole assets from payment provider Triple-A’s own treasury, with publicly estimated losses of approximately bridging the funds to Ethereum and swapping assets, the attacker split the funds between two intermediary addresses on September 6.
On October 9, the attacker routed both streams through a single wallet and deposited them into Tornado Cash in 49 transactions of 100 ETH and seven transactions of 10 ETH. One stream included funds from earlier mixer withdrawals.
In July, the attacker stole assets from payment provider Triple-A’s own treasury, with publicly estimated losses of approximately bridging the funds to Ethereum and swapping assets, the attacker split the funds between two intermediary addresses on September 6.
On October 9, the attacker routed both streams through a single wallet and deposited them into Tornado Cash in 49 transactions of 100 ETH and seven transactions of 10 ETH. One stream included funds from earlier mixer withdrawals.
On 25 July 2026, Triple-A identified unauthorized access to certain wallets containing the company’s own digital assets.
Client funds were not affected. Triple-A does not provide digital assets custody on behalf of its clients, and client funds are held separately in trust h safeguarding institutions that were not exposed.
As a precaution, certain services were temporarily placed into maintenance mode for approximately three hours while we secured the affected infrastructure and completed security checks. All services have since been restored, and transactions and settlements are processing normally across all markets.
The incident affected only Triple-A’s own treasury assets. Triple-A remains well capitalised, is able to meet all its liabilities and continues to operate globally at normal service levels. The financial impact is limited to specific operational accounts and is being fully absorbed from Triple-A’s treasury reserves.
We are working with internal and external cybersecurity experts, blockchain forensics specialists and the relevant authorities, including the Singapore Police Force, to investigate the incident, trace the affected assets and support recovery efforts.
Clients with questions should contact their dedicated account manager or email support@triple-a.io.
0
0
4
54,715
🚨@RevenueFamily involves malicious approvals. The perpetrators submit users’ permit signatures to obtain unlimited permission to spend their USDG, then immediately call transferFrom. The approval and fund transfer are completed in the same transaction, draining users’ wallets
it 20%/80% between two hacker addresses. This distribution structure resembles Inferno’s drainer-as-a-service model, and its promotional approach matches FomoPeek’s model of using KOLs to carry out scams
it 20%/80% between two hacker addresses. This distribution structure resembles Inferno’s drainer-as-a-service model, and its promotional approach matches FomoPeek’s model of using KOLs to carry out scams
0
1
8
4,825
We have conducted comprehensive tracing and forensic analysis of the funds stolen from @bitget . The funds are currently held at the addresses listed below, although some remain in motion.
Based on our previous experience responding to incidents involving North Korean threat ezing these assets is likely to be highly challenging. We recommend that Bitget adopt a white-hat bounty program similar to @Bybit_Official ’s model, incentivizing more leading security firms and independent researchers to continue monitoring and tracing the stolen funds.
ETH：
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54
0xeD5a394a7558929112848B7e97B569de6bbE1A51
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284
0xe07bd590e1198666230932bad5db3dbbe21e7d57
USDT / USDC：
0xe07bd590e1198666230932bad5db3dbbe21e7d57
BNB：
0x150889FE4fA7a7699588f75C4189FA9e721acFD3
0x3a82a441f1e75d2022d17f6b082979c04fd67652
0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7
0x2399548147f367375b798256cc620cf2dbac7f10
BTC：
13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T
XRP：
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y
rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p
r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET
r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7
rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR
rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C
r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
RLUSD：
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD
TRX：
TBWNguTTgezw9dVorX441C6nDrZpRxYwKD
@GracyBitget @xiejiayinBitget
Based on our previous experience responding to incidents involving North Korean threat ezing these assets is likely to be highly challenging. We recommend that Bitget adopt a white-hat bounty program similar to @Bybit_Official ’s model, incentivizing more leading security firms and independent researchers to continue monitoring and tracing the stolen funds.
ETH：
0xD2C2f029eFF5caCc686F24377CfdDcfc82d9F899
0x600cfeDc6Bd65Fa79B604dC44964f419e45784b2
0xDc2901f741B4003e32B8B752e97b8c4C1891dC63
0x9FA39d62095302431d7d4167a7E80F8Ec6eA4FA0
0xA6BFd7FcaF4711dA1f61D5E91d03A2c7C72dB272
0xFd5EBe912e2061992437767e24e5BCb52a3f9e54
0xeD5a394a7558929112848B7e97B569de6bbE1A51
0x52f08Feb1B0Da609A5442514E2Bb43C99D25d284
0xe07bd590e1198666230932bad5db3dbbe21e7d57
USDT / USDC：
0xe07bd590e1198666230932bad5db3dbbe21e7d57
BNB：
0x150889FE4fA7a7699588f75C4189FA9e721acFD3
0x3a82a441f1e75d2022d17f6b082979c04fd67652
0x03df4cb9aa0e73a847b2989c1cd00a2a654b32f7
0x2399548147f367375b798256cc620cf2dbac7f10
BTC：
13RcS1N99wQeD6WvjWqS1L6CwheEKBVC7T
XRP：
rDRV9nLg8xbLsafKZnhNgWuE1TiSLE95hs
r3UGfDM4ZyFSCzKH7TQEjgago9QoUJagtJ
rH7oMFKBgdK99TPQctFVzddD7srRzyCqZn
rwSjBrtxBC75TqZ5YvJ1TGfaRpQvVNsAKw
r6NcwN3dR5ciyBv9XsLyMNc9Kg2FBCs7Y
rhdAf73TPX45LmHeZqxzLMdtd44jrY2w3p
r4duMqEXMMmWpaN8LC2URmmVE2JkqTT5ig
rHCPH9VCKvYRsQ2eJBFydpLqLqb5S6a3ET
r3PkiYKo2yFiunHuEGHtTMFPQXEgyCkWj7
rnHdntCUt2vU8YMXarhvSeDRrZ8xwaFcTR
rwRnFu7QeQcd7p5qvyHkububNrfPRyEf2C
r4vyVuh8QXvUHh7HFt4EiFLDVFkTBe7fJx
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
RLUSD：
rQKChXgu2AkqUcGTth2FYHVu93aNYsURZw
rD5AL2MtdRUfDXJF8GPK5CpSF3ZNKKgp6z
r4CAbSkDf4MgGZjao78Ufcks3jxr2UiPfD
TRX：
TBWNguTTgezw9dVorX441C6nDrZpRxYwKD
@GracyBitget @xiejiayinBitget
1
2
8
30,554
802.5 ETH entered Tornado Cash through
0x29352a44cf77f276a52c1275c564a7530ba34c55
between 19:32 and 19:51 UTC on Sep 23, 2026.
Cross-chain reconstruction and fund tracing identified links between upstream addresses and Huione, Xinbi, and a cluster of sanctioned addresses.
0x29352a44cf77f276a52c1275c564a7530ba34c55
between 19:32 and 19:51 UTC on Sep 23, 2026.
Cross-chain reconstruction and fund tracing identified links between upstream addresses and Huione, Xinbi, and a cluster of sanctioned addresses.
1
0
7
5,585
Salus has completed a smart contract security audit of @KeyFlow_EN’s KEYFlexibleStake
Developed by the KeyFlow team and deployed on @BNBCHAIN, the contract supports multiple asset configurations to provide users with a more flexible on-chain staking and asset management ocused on signature verification, access control, core business logic, and critical execution paths—helping the team identify potential risks and further strengthen the contract’s security and reliability
No high- or medium-severity issues were identified within the audited scope
Read the full audit report:
github.com/Salusec/Salus-…
Developed by the KeyFlow team and deployed on @BNBCHAIN, the contract supports multiple asset configurations to provide users with a more flexible on-chain staking and asset management ocused on signature verification, access control, core business logic, and critical execution paths—helping the team identify potential risks and further strengthen the contract’s security and reliability
No high- or medium-severity issues were identified within the audited scope
Read the full audit report:
github.com/Salusec/Salus-…
1
1
5
37,097
We’re hiring a part-time Channel Business Development professional to join our Partnerships & Business Development team!
Salus specializes in smart contract audits, Web3 penetration testing, and asset recovery services, providing professional security support for Web3 projects.
Our
🟠 300+
Projects served and protected
🔴 0 REKT
Publicly disclosed security record of protected projects
🟠 100%
Project security rate disclosed on our official website
🔴 100%
Penetration testing success rate disclosed on our official website
You’ll work with us to:
• Support high-quality Web3 projects with security needs
• Develop partnership channels through communities and ecosystem partners
• Follow up with prospective clients and partnership opportunities
• Help build stable, long-term ecosystem partnerships
Experience in business development, channel partnerships, or community operations is a plus.
Part-time · Fully remote
Industry-competitive compensation and incentives
Send your CV or a brief introduction to hr@salusec.io. For the fastest response, you can also DM @Jack24klove or @DarcyAri directly.
Email subject: Part-time Channel BD
Know someone who might be a great fit? Feel free to share this opportunity or refer them to us!
Salus specializes in smart contract audits, Web3 penetration testing, and asset recovery services, providing professional security support for Web3 projects.
Our
🟠 300+
Projects served and protected
🔴 0 REKT
Publicly disclosed security record of protected projects
🟠 100%
Project security rate disclosed on our official website
🔴 100%
Penetration testing success rate disclosed on our official website
You’ll work with us to:
• Support high-quality Web3 projects with security needs
• Develop partnership channels through communities and ecosystem partners
• Follow up with prospective clients and partnership opportunities
• Help build stable, long-term ecosystem partnerships
Experience in business development, channel partnerships, or community operations is a plus.
Part-time · Fully remote
Industry-competitive compensation and incentives
Send your CV or a brief introduction to hr@salusec.io. For the fastest response, you can also DM @Jack24klove or @DarcyAri directly.
Email subject: Part-time Channel BD
Know someone who might be a great fit? Feel free to share this opportunity or refer them to us!
12
2
19
82,585