Which nested services did the the stolen funds get transferred to?
HitBTC is using bitcoin address that starts from 3. Bitcoin addresses that start from 3 are nested addresses for single signature. Probably that is what they are referring to as nested service. I am not really sure about it. If it is multisig address, it is still referred to as legacy bitcoin address but multig. I do not know if HitBTC is using singlesig or multisig. Multisig is longer and have 64 characters.