Protos reported that HTX’s reserve management changed after both the Council of the European Union and the UK Foreign, Commonwealth & Development Office chose to sanction the exchange. According to the report, HTX’s position has looked increasingly fragile since those actions, and the exchange has made major adjustments to how it handles user reserves.
The outlet said HTX’s June proof-of-reserves report was the first to acknowledge that large portions of reserves had been moved to an undisclosed third party. HTX says on its website that users can verify those balances by contacting the custodian, Protos wrote, but the exchange does not say who that custodian is. Protos said that left most of the balances impossible for it to verify.
Protos also pointed to a report from blockchain intelligence firm TRM Labs, which described HTX as rotating wallets at a prodigious rate. Ari Redboard, TRM’s global head of policy, said the pattern looked like an attempt to stay ahead of screening systems built on static lists. HTX had previously said the activity was entirely normal cybersecurity behavior.
Protos added that it had already tracked a substantial share of HTX’s staked ether holdings, or stETH, through Poloniex addresses. It now says other HTX assets have recently moved into Poloniex as well, raising the question of whether Justin Sun is mixing HTX reserves with Poloniex.
How Protos traced the transfers
According to the report, HTX previously distributed a tool that gave users deeper visibility into its reserves, including the addresses where those reserves were held. Protos said those historical reports can be matched with blockchain transactions to trace where part of the reserves later moved.
One example in the report is 0x18709e89bd403f470088abdacebe86cc60dda12e, an address Protos said HTX used to hold many of its Ethereum-based DeFi positions. On May 30, immediately before the shift to the third-party arrangement, wrapped BTC, or WBTC, linked in the report to Sun moved from that HTX address to 0xeB245796376912af7Fadd4986f73743feEA61e6E.
The funds then moved to 0x8fCA4adE3a517133fF23ca55CdAea29C78C990b8, which Etherscan labels as Poloniex 7. From there, they were quickly sent to 0x29065a4C1f2F20d1E263930088890d6F49Fe715a, labeled by Etherscan as Poloniex 10. The WBTC was then transferred to 0x176F3DAb24a159341c0509bB36B833E7fdd0a132, an address Etherscan labels as Poloniex 9. Protos said that WBTC, which originated from HTX, is still stored at that Poloniex address.
The same route appeared in other assets
Protos said HTX’s May proof-of-reserves report had a problem of its own. The report claimed an address held STEAK-USDC, but Protos said that was incorrect because there was no STEAK-USDC in that address on that date.
There was, however, a matching amount of Sky Savings USDS, or sUSDS, in the address, according to the report. Protos said that suggested HTX had another position representing the same value, even though the exchange had failed to label its own reserves accurately.
Protos traced roughly $200 million in sUSDS to 0x7fed2E5e06CF7B8918bB93158C4E990794da33b8. The funds then moved to Poloniex 7, were forwarded in three transactions to Poloniex 10, and were later sent to Poloniex 9.
The outlet said similar patterns can also be seen in various Spark positions, some of which may since have been redeemed.
Questions raised in the report
Protos said these related-party transfers involve many hundreds of millions of dollars in value and raise serious questions about internal controls and management at the two exchanges owned by Justin Sun. The report also raised questions about Poloniex’s role in interacting with an entity that it described as repeatedly sanctioned.
Protos said it contacted HTX with questions about the transfers, but the exchange did not respond before publication.