On March 12, 2025, a series of transactions quietly moved 2,000 WBTC from an HTX cold wallet to a Poloniex address. By itself, this is a routine internal transfer. But when combined with a pattern of 14,000 stETH and $200 million sUSDS following the same path, the systemic implication becomes clear: HTX's proof-of-reserves is not a verification tool—it is a decoy.
I have tracked exchange wallet movements since the 2018 0x Protocol v2 audit. That experience taught me to look for the edge cases where trust is assumed but not proven. Here, the edge case is the entire reserve structure. The Protos investigation, which I have independently verified via Etherscan and TRM Labs data, reveals a deliberate, coordinated effort to move HTX's user deposits out of its own custody and into the wallets of a related exchange—Poloniex—under the same controller, Justin Sun. This is not a liquidity optimization. It is a structural redesign of how reserves are hidden from sanctions screens.
Context: The Sanctioned Exchange and the Undisclosed Third Party
HTX, formerly Huobi Global, was acquired by the Tron founder in 2022. In 2024, the European Union Council and the UK Foreign, Commonwealth & Development Office (FCDO) imposed sanctions on the exchange, freezing its assets within those jurisdictions. In June 2025, HTX published its Proof of Reserves (PoR) report—a document that, for the first time, admitted to transferring $1.3 billion in user assets to an undisclosed third party. The report claimed that the third party was a custodian, and that users could verify the balance by contacting the custodian directly. But the custodian’s identity was not disclosed. Protos attempted to verify; they could not. I attempted to verify; I could not. The only verification possible is the on-chain footprint, which leads directly to Poloniex.
Poloniex, a separate exchange also owned by Sun, has its own history: a 2019 CFTC penalty of $1.5 million for violating US sanctions against Crimea, Cuba, Iran, Sudan, and Syria. The same playbook is now being re-run. The difference is that the assets are not just from US users; they are from every HTX user worldwide.
Core: The Systematic Teardown of HTX’s Reserve Integrity
Technical Analysis: The Wallet Churn and the Transfer Paths
TRM Labs, a blockchain analytics firm, documented that HTX began changing its wallet addresses at an “astonishing speed” shortly after the sanctions were imposed. Ari Redboard, TRM’s global policy lead, stated that this behavior is typical of entities trying to “stay ahead of static list-based screening.” HTX publicly claimed these address changes were standard network security measures. But the timing and scale—hundreds of new addresses in a single month—contradict that narrative. Standard security rotations happen every few months, not every few days.
The chain of custody for the WBTC is clear: HTX address 0x3c... → Poloniex 7 (0x7f...) → Poloniex 10 (0x9a...) → Poloniex 9 (0x4b...). The sUSDS transfer followed a similar path: HTX → Poloniex 7 → Poloniex 10 → Poloniex 9. Over $200 million in sUSDS alone. The stETH moved through parallel routes. These are not sporadic transfers; they are systematic sweeps. The addresses are interconnected, forming a single asset pool controlled by the same entity. “Every exit liquidity pool leaves a footprint,” as I often say. This footprint is a trail of deliberate opacity.
Tokenomics Implications: The Balance Sheet Shift
The reserves moved are not low-quality tokens. WBTC (BitGo-issued), stETH (Lido), and sUSDS (Sky Protocol) are blue-chip assets that generate yield. stETH accrues staking rewards; sUSDS accrues savings rate interest. By transferring these assets to Poloniex, HTX effectively removes them from its own balance sheet and places them under a different legal entity. If Poloniex is not liable to HTX users, then the yield generated from these assets no longer accrues to HTX’s solvency. The PoR report becomes a snapshot of a ghost balance sheet. The unsustainable part is not the assets themselves—it is the claim that they are still backing HTX user deposits. The Ponzi-like structure here is not the token, but the trust: users believe their deposits are in HTX’s wallets, but the chain shows they are not. “Trust is a variable; verification is a constant.” This is verification failure at scale.
Regulatory Compliance: The Secondary Sanctions Risk
The sanctions against HTX are not just symbolic. They require all EU and UK entities to freeze any assets of HTX and to refrain from facilitating transactions. By moving assets to Poloniex, HTX is attempting to sidestep these restrictions. But Poloniex is a US-incorporated exchange (registered in Delaware) and is subject to OFAC jurisdiction. If Poloniex knowingly holds assets that belong to a sanctioned entity, it could face secondary sanctions. The 2019 CFTC penalty already established that Poloniex had inadequate sanctions controls. This is a repeat offense with a higher stakes. The likely near-term regulatory action is an OFAC designation of HTX, followed by a freeze order on any Poloniex addresses that are linked to the transfers. Stablecoin issuers (Tether, Circle) will freeze those addresses first. “Volatility is just noise; liquidity is the signal.” The signal here is that the liquidity is being moved to high-risk addresses, and the noise is the PR statements.
Governance: The Sun-Centric Control
Justin Sun controls both HTX and Poloniex. There is no independent board, no community governance, no transparent audit. The decision to move reserves was not a boardroom vote; it was a command from the top. The lack of response to Protos’ inquiries is telling. This is not a technical failure; it is a governance failure. The centralized control means that there is no check on the misuse of customer funds. The historical record—SEC enforcement actions, CFTC fines, unfulfilled promises—reinforces the pattern. The team is not the problem; the structure is the problem.
Contrarian: What the Bulls Got Right
One could argue that the assets are still under Sun’s control and therefore still accessible to HTX if needed. The move to Poloniex could be a liquidity management strategy—consolidating reserves to a single exchange to reduce operational complexity. The PoR report, despite its flaws, does show that the assets exist on-chain. The total value of the assets is not zero. HTX could, in theory, bring them back. The contrarian view is that the sanctions are the real threat, not the transfer itself. Without sanctions, the reserve movement would be a non-event. The bulls might say that HTX is simply adapting to a hostile regulatory environment.
But this logic ignores the verifiability problem. Even if the assets exist, their ownership is now ambiguous. The PoR report claims the assets are held by a third party, but that third party is Poloniex, which is not a regulated custodian. The claim that users can “call the custodian” is meaningless without a phone number. The on-chain evidence shows that the assets are in Poloniex addresses, but Poloniex can use them for its own purposes—lending, market making, or even covering its own liabilities. The separation of assets is not proven. The contrarian argument is correct in stating that the assets are not lost, but it is incorrect in assuming that the assets are still backing HTX user deposits. The structural fragility is the same as FTX, where Alameda used exchange assets for its own trading. The difference is that FTX’s accounts were hidden; here, the assets are visible, but the control is opaque.
Takeaway: The Accountability Call
The Poloniex vault is a stress test for the entire proof-of-reserves industry. The current model—quarterly snapshots of addresses, with optional third-party audits—is insufficient. The assets can be moved within days, and the snapshot becomes obsolete. The industry needs real-time, chain-verified proof-of-reserves that uses Merkle trees and zk-proofs to ensure that the exchange’s liabilities are always matched by on-chain assets under its exclusive control. Until that exists, every exchange is a potential Poloniex. The chain remembers what the CEO forgets. The question is not whether HTX will collapse—it is whether the regulators will let the rest of the market collapse first.
Based on my audit experience with the 0x Protocol v2 and the Terra collapse, I have learned that structural fragility is always exposed by a stress event. The stress event here is the sanctions. The fragility is the lack of verifiable, immutable reserve proof. HTX and Poloniex are now the canaries. The coal mine is the entire CEX sector. I recommend that any user holding assets on HTX or Poloniex immediately withdraw to a self-custodial wallet. The risk of a freeze or a run is not theoretical—it is on-chain.