We found HTX’s reserves at Poloniex

$HTX’s situation has appeared increasingly precarious as both the European Union Council and the United Kingdom’s Foreign, Commonwealth, & Development Office have chosen to sanction the exchange.

Since then, it’s made some big changes to how it manages users’ reserves.

Its June proof of reserves report was the first that acknowledged that it had moved huge swaths of its reserves to an undisclosed “ThirdParty.”

$HTX claims on its website that you can verify these balances by reaching out to the custodian; unfortunately, it doesn’t tell users who that custodian is. As a result, Protos has been unable to verify most of those balances.

Further complicating this, TRM Labs, a blockchain intelligence firm, released a report in which it detailed how $HTX has begun churning through its wallets at a prodigious rate.

Ari Redboard, the global head of policy for TRM, described this behavior as an attempt “to stay a step ahead of screening built on static lists.”

$HTX, for its part, previously claimed that this was totally normal cybersecurity behavior.

Since then, Protos was able to track a substantial portion of $HTX’s staked ETH (stETH) through Poloniex addresses.

Now, we can add that various other $HTX assets have also recently passed into Poloniex.

First, $HTX distributes a tool that used to enable people to gain greater insight into its reserves, even including which addresses the reserves were held in.

We can use these past reports to determine where certain assets were claimed to be at a certain time and can use the blockchain transactions to follow some portion of the reserves as they move.

Consider 0x18709e89bd403f470088abdacebe86cc60dda12e, which was an address that $HTX used to hold many of the Ethereum-based DeFi positions it maintained, for some reason.

On May 30, immediately before we get the transition to ThirdParty, we can watch the Sun-advised wrapped BTC (WBTC) move from this $HTX address to 0xeB245796376912af7Fadd4986f73743feEA61e6E.

These funds were then transferred to 0x8fCA4adE3a517133fF23ca55CdAea29C78C990b8, an address that Etherscan labels as Poloniex 7.

These funds were then quickly sent to 0x29065a4C1f2F20d1E263930088890d6F49Fe715a, an address that Etherscan labels as Poloniex 10.

Finally, this WBTC was sent to 0x176F3DAb24a159341c0509bB36B833E7fdd0a132, an address that Etherscan labels as Poloniex 9.

This WBTC which came from $HTX, is still stored in this Poloniex address.

The $HTX to Poloniex pattern repeats

The May PoR for $HTX had a problem. It claimed that it had a bunch of STEAK-$USDC, but it was wrong; there was no STEAK-$USDC in that address on that date.

However, there was a matching amount of Sky Savings USDS (sUSDS) in that address, suggesting that while $HTX failed to accurately label its own reserves — troubling on its face — it did have another position that represented that value.

We start with approximately $200 million worth of sUSDS moving to 0x7fed2E5e06CF7B8918bB93158C4E990794da33b8.

These funds are then sent onward to Poloniex 7.

These were then forwarded in three transactions to Poloniex 10.

Finally, these funds were forwarded to Poloniex 9.

Similar patterns can also be observed for various Spark positions, some of which may have been since redeemed.

These related-party transactions, involving many hundreds of millions of dollars worth of value, raise serious questions about the internal controls and management of both of these Sun-owned exchanges.

They furthermore raise questions about Poloniex’s role in interacting with this repeatedly sanctioned entity.

Protos reached out to $HTX with questions about these transfers, but it didn’t respond before publication.