A Solana wallet received $36.3M from Bridge. No public label, no name. It moved almost everything onward to a single Binance deposit address. So we followed the money — and reconstructed who was operating it.
The $36.3M is the hook. The interesting part is that the wallet carried no label, and we identified its operator anyway: by following where the money came from, where it went, and which known infrastructure it shares a settlement endpoint with. We attributed it to Busha. Here's how we got there.
Before the number travels: this $36.3M is one observable USDC settlement route on Solana. It isn't Busha's total volume, its total Solana activity, or its customer deposits. It's one route — and a figure like this gets screenshotted without the methodology.
Where the money went
Between 14 February 2025 and 19 May 2026, the wallet took in $36,276,129 in USDC from Bridge, the stablecoin orchestration service. The tickets were institutional-sized, $300K to $1M each, and 94% arrived from one Bridge wallet. This wasn't retail flow. It was a steady liquidity line.
Almost all of it left again, in one direction. $34,845,394 went to a single Binance deposit address — the overwhelming majority — which in turn sweeps to a Binance hot wallet our records already know as "Binance 1".
One number doesn't fit that clean line, and it needs accounting for before anything else. The wallet also sent $4,806,290 on a second route, through an intermediate address to a Fireblocks-custodied omnibus — a shared institutional settlement endpoint that other Nigerian venues also reach. That $4.81M is not part of the Bridge-to-Binance corridor; it's funded from the wallet's other, non-Bridge inflows. Over its whole life the wallet took in $43.6M and sent out $41.8M, with the remaining balance still sitting in it.
Every figure here is read straight from the wallet's Solana token accounts. That lets us measure the wallet's movements directly rather than leaning on indexed owner-level tables.
The missing label
Here's the problem. You can watch $36.3M move through this wallet, one transaction at a time, and still not know who owns it. There's no explorer label reading "Busha". On Solscan it's an anonymous address moving money between two other anonymous addresses.
A label would be an assumption. So we didn't assume — we tested. The test rests on one observable fact: where this wallet settles, and who else settles there.
The Busha connection
The unlabelled conduit sends its money to a Binance deposit address. That same address is already used by infrastructure we independently attribute to Busha: its retail collection wallet — the one that gathers customer deposits, which we identify from the deposit-sweep graph, not from any label — also settles into it.
The wallet doesn't say Busha anywhere. The connection comes from the money — two wallets, one of them already tied to Busha, settling into the same endpoint.
The attribution test
Laid out as a test you can follow:
- The unlabelled conduit's dominant outflow, $34.85M, lands at one Binance deposit address.
- Busha's known retail collection wallet also funds that same Binance deposit address ($390K).
- Of everything that Binance deposit address receives — $35.49M in total — 99.3% ($35.24M) comes from Busha wallets: $34.85M from the conduit and $390K from the collection wallet. The only non-Busha inflow is a single $250K transfer (0.7%). It behaves as a predominantly Busha-funded endpoint.
- Two wallets consistently settling into the same predominantly Busha-funded Binance endpoint operate as part of the same settlement system.
That's why we attribute the conduit to Busha. A shared settlement endpoint is behavioural evidence, not a naming certificate. We're not claiming the address carries a Busha label; we're showing why its behaviour connects it to Busha's known infrastructure.
The full route
With the attribution made, we can name it.
The flow is consistent with Busha sourcing dollar liquidity through Bridge and settling it into the Binance deposit infrastructure we attribute to Busha — though the wallet's exact operational purpose is inferred from its behaviour, not proven.
The route goes quiet
The route took its last inflow from Bridge on 19 May 2026, and has been silent since. That's a real stop, not a gap in our data: over the same months Bridge stayed highly active on Solana — $1.59B in August 2026 and $812M in September — running right up to now. This one route wound down while the rail it used kept running.
The pipe went quiet. We don't know why.
We can see when it stopped; we can't see why. It would be wrong to say "Busha stopped using Bridge" — we still see small Bridge activity on other chains, and a company can move a route without dropping a provider. If we later establish what replaced it, that's a separate finding.
What the $36.3M is — and is not
This is one observable USDC settlement route on Solana that we attribute to Busha. Solana is effectively all of the Bridge-to-Busha flow we see; Bridge activity on other chains is a rounding error. It is not Busha's total volume, its total Solana activity, its total Bridge activity, its customer deposits, or its entire settlement footprint. We don't reconcile it against any figure Busha may publish — it's a different measurement.
Why this matters
Most financial infrastructure onchain doesn't come with a neat label. A wallet can be anonymous. A settlement route can pass through several intermediaries. The same company can appear as different addresses on every chain.
But money leaves a pattern. By following those patterns — where funds arrive, where they leave, who they settle with, and how those relationships overlap — infrastructure becomes reconstructable even when the labels aren't there. That's what we did here. The $36.3M is the case study; the reconstruction is the point.
Methodology and limitations
- Measured from token accounts, not labels. Every figure is read directly from the Solana token accounts of each wallet — the way to measure SPL flow, since a transfer credits the token account, not the owner. Indexed tables that resolve to the owner undercount; summing two such tables double-counts. We use neither. We scan the accounts.
- Ground truth at the ends. The Binance hot wallet is a labelled endpoint in our exchange data ("Binance 1"); the Binance deposit that feeds it is independently confirmed. The two Bridge endpoints are confirmed in our Bridge-address registry.
- Attribution by shared endpoint. The conduit is tied to Busha because it and Busha's known collection wallet both settle into the same Binance deposit address, 99.3% Busha-funded across its whole inflow.
- Reconciliation. $36.3M in from Bridge; $34.85M out to the Binance deposit; a separate $4.81M to a Fireblocks omnibus; $43.6M total in and $41.8M out, with the balance still in the wallet. The corridor and the second route are never merged.
- Scope. This is USDC on Solana — one route in our coverage, a floor and a slice, not Busha's total activity on any measure. Wallet and exchange attributions describe how infrastructure behaves and who operates it, never who any individual customer is. We can see that value arrived, was forwarded, and where it settled; we can't see what Busha received or did with it once at Binance.
Figures as of 22 September 2026, reproducible from public chain data.
