The Reserves That Vanished: A Forensic Analysis of HTX's $1.3B Transfer to Poloniex

The chain of custody is the only truth that survives in a market built on trustlessness. On the evening of June 14, 2025, Protos published a piece of investigative journalism that should have been the lead story on every crypto news site. Instead, it was buried under yet another AI-aggregator hype cycle. The article traced a series of on-chain transactions that link HTX, the Seychelles-registered exchange formerly known as Huobi, to a wallet cluster controlled by Poloniex, another exchange under the same ultimate beneficial owner, Justin Sun. The transfers amount to at least $1.3 billion in WBTC, stETH, and sUSDS. This is not a rumor. The data is on Ethereum, timestamped, and immutable. And yet, the industry's response has been a collective shrug. Code does not lie, but the auditors often do. And when the auditors are silent, the code screams. Let me set the stage. I have spent the last eight years auditing smart contracts and exchange infrastructure. I have seen the inside of proof-of-reserve reports from half a dozen major platforms. I know the difference between a real, verifiable Merkle tree and a PDF signed by a compliance officer who has never touched a command line. HTX's recent PoR disclosure is the latter. In June 2025, HTX acknowledged for the first time that it had transferred a significant portion of its user reserves to an undisclosed third-party custodian. The stated reason: to comply with sanctions imposed by the European Council and the UK Foreign, Commonwealth & Development Office. The actual reason, as the blockchain clearly shows, is to move assets out of reach of those same sanctions while keeping them under the control of the same entity. The third party, as it turns out, is Poloniex. The context is essential. HTX has been under EU and UK sanctions since early 2025. These sanctions freeze any assets held by HTX within those jurisdictions and prohibit persons within those jurisdictions from transacting with the exchange. In response, HTX began a frantic reshuffling of its on-chain wallets. TRM Labs, a blockchain intelligence firm, documented a pattern of wallet rotation that they described as “unprecedented”—addresses being created and discarded at a rate that far exceeds normal operational security. The stated reason from HTX was “cybersecurity.” The actual reason, according to TRM’s global policy head, Ari Redboard, was to “stay ahead of static list-based screening.” In other words, HTX was trying to evade sanctions compliance tools by changing its wallet addresses faster than the blacklists could be updated. Security is a process, not a badge you wear. And the process here is evasion, not protection. Now let me walk you through the core technical analysis. The on-chain trail is almost embarrassingly simple to follow. Using Etherscan and basic address clustering, anyone can trace the flow. Let me give you one concrete example. On June 10, 2025, a known HTX cold wallet sent 2,100 WBTC (approximately $140 million at the time) to an address labeled Poloniex 7. Within 24 hours, that address forwarded the WBTC to Poloniex 10, and then to Poloniex 9, where the tokens remain as of this writing. The same pattern repeats for stETH: multiple transfers from HTX addresses to Poloniex clusters, with no corresponding outflow. The sUSDS transfers are even more revealing. Approximately $200 million in sUSDS—a stablecoin issued by the Sky protocol (formerly MakerDAO)—moved from an HTX treasury address through a chain of three intermediate wallets before landing in Poloniex 9. Not a single token has been returned. This is not a temporary liquidity arrangement. This is a permanent transfer of assets from one exchange’s balance sheet to another’s. But the most damning evidence is the discrepancy between HTX’s proof-of-reserve report and the on-chain reality. The June 2025 PoR report claimed that HTX held a position of STEAK-USDC (a liquidity provider token) in a specific address. When Protos checked that address on-chain, they found not STEAK-USDC but sUSDS. The value was roughly the same, but the asset was different. This is not a minor error. A proof-of-reserve system that cannot accurately identify the underlying asset is worse than useless—it is a deliberate obfuscation. Either the report was generated with sloppy data aggregation, or the assets were swapped after the snapshot was taken. Either way, it invalidates the entire premise of the PoR. Let me add my own experience here. I have audited the smart contract infrastructure for several exchanges that attempted to implement a “third-party custodian” model. In every case, the custodian was either a shell company owned by the same parent group or a licensed entity that refused to provide on-chain verification. The pattern is consistent: the exchange claims the assets are safe, the custodian claims to hold them, but neither side provides a cryptographic proof that the user can independently verify. We built a house of cards on a ledger of trust. And the house is now leaning. Now, the contrarian angle. A defender of HTX might argue that the transfers are legitimate liquidity management. Poloniex and HTX are both owned by the same parent, so moving assets between them is no different than a bank transferring funds between its branches. The PoR error could be a one-time mistake. The wallet rotation is standard security practice. And the sanctions are a political issue, not a technical one. There is even a grain of truth in each of these points. Inter-exchange transfers do happen. Mistakes in reporting do occur. And wallet rotation is indeed a common security measure. But the totality of the evidence cannot be dismissed by isolated justifications. The volume of transfers, the timing (immediately after sanctions), the explicit guidance from TRM Labs that the wallet rotation is evasive, and the refusal to disclose the custodian’s identity—when you combine these signals, the probability of innocent intent drops to near zero. More importantly, the contrarian narrative ignores the structural risk. Even if the transfers were legitimate, the fact that one person controls the reserves of two exchanges creates a single point of failure. If Justin Sun were to be hit with a personal sanction (as has been rumored by OFAC for years), both HTX and Poloniex would be frozen simultaneously. The users would have no recourse. The third-party custodian is a fiction when the third party is yourself. The industry has learned this lesson before. In 2022, FTX and Alameda Research were presented as separate entities, but the on-chain evidence showed massive inter-company transfers. The same pattern is now visible between HTX and Poloniex. The only difference is that this time, one of the entities is already under sanctions. What does this mean for the market? The immediate risk is a bank run. If HTX users become sufficiently alarmed, they will withdraw their funds. HTX’s liquidity will be tested. The exchange cannot rely on the Poloniex reserves to cover withdrawals because those reserves are now legally under Poloniex’s balance sheet. And Poloniex itself could face a secondary sanctions designation if the U.S. Treasury decides that Poloniex is knowingly facilitating transactions for a sanctioned entity. The risk matrix is clear: high probability of regulatory escalation, medium probability of a liquidity crisis, and low but non-zero probability of a full collapse. I have seen this trajectory before. In my 2018 audit of a now-defunct exchange, I flagged a similar pattern of reserve transfers to a sister company. The exchange went bankrupt within six months. The warning signs are identical. From a regulatory perspective, this case is a textbook example of how proof-of-reserve systems fail when they are not grounded in cryptographic verification. The EU and UK sanctions are the triggers, but the underlying problem is the lack of a standardized, real-time, and self-custodial proof mechanism. The industry has been talking about “real-time reserves” for years, but no major exchange has implemented it. Instead, they hire auditors to produce PDFs that are outdated the moment they are published. The HTX-Poloniex case should be the catalyst for a new standard. Every exchange should be required to maintain a smart contract-based reserve proof that allows users to independently verify the total assets at any time. Until then, every user is trusting a CEO, not a cryptographic hash. Let me end with a takeaway that is not a summary but a call to accountability. The next time you see an exchange tweet about its “proof of reserves,” ask yourself: can I verify this on-chain in under five minutes? If the answer is no, the proof is worthless. The blockchain is not a marketing tool. It is a public ledger of truth. And the truth about HTX is that its reserves are no longer on its own balance sheet. They are sitting in Poloniex’s wallets, under the same control, but now outside the reach of the sanctions that were meant to protect users. We built a house of cards on a ledger of trust. It is time to tear down the house and rebuild with concrete foundations. The math is not the problem. The governance is. And governance is just another word for accountability.