The data indicates that over the past six months, more than $2 billion in user assets—WBTC, stETH, and sUSDS—have flowed from HTX wallets to Poloniex addresses. The transfer path is not a one-off. It is a systematic, recurring pattern.
Bug.
This is not a routine liquidity rebalancing between affiliated exchanges. It is a survival mechanism under EU and UK sanctions. And it is a structural failure of Proof of Reserves (PoR) as a trust mechanism.
Context: The Sanctioned Exchange and Its Shadow
HTX, formerly Huobi, is a Seychelles-registered exchange long associated with Justin Sun. In early 2025, the European Council and the UK's FCDO imposed sanctions on HTX for alleged ties to illicit finance. Sun's other exchange, Poloniex, remained sanction-free—at least on paper.
In June 2025, HTX published its monthly PoR report. Buried in the fine print was a confession: $1.3 billion in user reserves had been transferred to an undisclosed third-party custodian. The identity of that custodian was not revealed. The report claimed users could verify the balance by calling the custodian—but provided no phone number or name.
Protos, a blockchain investigative outlet, did what any competent forensic analyst would do: they followed the on-chain trail. What they found was a direct pipeline from HTX to Poloniex.
Core: The Systematic Teardown
Let me be clear: on-chain data is the only source of truth here. I've spent the last decade auditing tokenomics and smart contracts—from the 2017 ICO frauds to the 2020 DeFi exploits. I learned that when a project hides its counterparty, it is hiding a liability.
Path 1: WBTC
On March 14, 2025, a transaction moved 500 WBTC from an HTX-labeled address to Poloniex address 7. From there, it went to Poloniex 10, then to Poloniex 9, where it remains. The entire chain took 90 minutes. This is not a slow roll—it is a deliberate, rapid relocation.
Path 2: stETH
Multiple stETH transfers followed the same route. Lido's staked ETH, which generates yield, was moved out of HTX's control. The yield now accrues to Poloniex's wallet. From a user perspective, the economic benefit of their deposit has been reassigned without consent.
Path 3: sUSDS
Approximately $200 million in sUSDS (Sky's stablecoin) was transferred via a similar chain: 0x7fed2E... → Poloniex 7 → Poloniex 10 → Poloniex 9. The Spark positions—worth hundreds of millions—show the same pattern. Some have been partially redeemed; others remain parked.
The PoR Error
HTX's May 2025 PoR report claimed it held STEAK-USDC. On-chain, the same address held sUSDS. That is a factual error. In my 2020 audit of Compound's governance contract, I found a rounding error that could have drained $2 million. That was a bug. This is a lie.
The Wallet Rotation
TRM Labs, a blockchain analytics firm, noted that HTX has been rotating wallets at an alarming speed. Ari Redboard, TRM's global policy lead, stated this is a tactic to 'get ahead of static list-based screening.' HTX called it 'normal network security.'
In the absence of data, opinion is just noise.
The data shows a clear pattern: HTX is actively evading sanctions screening by cycling addresses. This is not security. It is adversarial compliance.
Technical Conclusion
HTX's PoR system has degraded from a verifiable on-chain model to an opaque, third-party custody scheme where the custodian is a sister exchange under the same ultimate controller. The user cannot independently verify the reserve. The code—the on-chain ledger—shows the assets have moved. The promise of segregation is broken.
Contrarian: What the Bulls Got Right
Some argue that the assets are still there, just on a different exchange. Poloniex is a legitimate platform with its own user base. The transfer could be a simple internal reallocation for operational efficiency. HTX still has a positive net worth—the funds are not lost.
There is a grain of truth here. The on-chain trail does not show theft. The assets are not in a black hole. They are in a wallet controlled by a known entity. The question is not solvency, but control.
However, the contrarian narrative misses the point. The risk is not insolvency today. It is the erosion of the legal and operational separation between a sanctioned entity and a non-sanctioned one. Once regulators see this level of commingling, Poloniex's clean status becomes a target.
Code has no mercy.
Takeaway: The Accountability Call
This is not a temporary liquidity crisis. It is a structural decay of trust in the entire Sun-controlled exchange ecosystem. The market will now demand real-time, verifiable proof of reserves—not quarterly reports with hidden custodians. If HTX and Poloniex cannot deliver that, the only remaining question is: how fast will the deposit outflow accelerate?
The answer will be written in the next on-chain data release.