Protos traces HTX reserve assets into Poloniex wallets after $1.3B moved to an unnamed custodian

HTX, the exchange associated with Justin Sun, shifted roughly $1.3 billion of customer reserves to an undisclosed entity its proof-of-reserves report calls only "ThirdParty," according to Protos, which says the June report was the first to acknowledge the arrangement. Protos now reports it has followed a substantial share of those assets on-chain into wallets that Etherscan labels as belonging to Poloniex — an exchange also owned by Sun.

The backdrop is sanctions. Protos notes both the Council of the European Union and the UK's Foreign, Commonwealth & Development Office have designated the exchange; it does not date those actions in this account.

The mechanics Protos lays out are specific. It starts from 0x18709e89…dda12e, an address HTX's own historical proof-of-reserves tooling identified as holding its Ethereum DeFi positions. On May 30 — immediately before the "ThirdParty" line appears — Protos says Sun-advised wrapped bitcoin (WBTC) left that address for 0xeB2457…61e6E, then moved to Etherscan-labelled Poloniex 7, then Poloniex 10, and finally Poloniex 9 (0x176F3D…d0a132), where Protos says it still sits.

A second trail follows the same route. HTX's May report listed a STEAK-USDC position that Protos says was not in the address on that date; a matching amount of Sky Savings USDS (sUSDS) was. Protos traced roughly $200 million of that sUSDS to 0x7fed2E…da33b8, on to Poloniex 7, then in three transactions to Poloniex 10, and finally to Poloniex 9. It reports similar patterns for Spark positions, some possibly redeemed since. It had earlier tracked HTX staked ether (stETH) through Poloniex addresses.

Separately, blockchain intelligence firm TRM Labs published findings that HTX is cycling through wallets rapidly. TRM global head of policy Ari Redboard characterised it as an effort "to stay a step ahead of screening built on static lists." HTX has previously called the practice routine cybersecurity, per Protos. HTX did not respond to Protos's questions before publication.

Key facts

• ~$1.3bn in HTX reserves reassigned to an undisclosed "ThirdParty" — HTX June proof-of-reserves report, via Protos
• HTX tells users to verify with the custodian but does not name it; Protos says it could not verify most balances
• WBTC path, May 30: HTX DeFi address → 0xeB24… → Poloniex 7 → Poloniex 10 → Poloniex 9 (Etherscan labels, via Protos)
• ~$200m sUSDS followed the same Poloniex 7 → 10 → 9 route (Protos)
• May report mislabelled a position as STEAK-USDC; a matching sUSDS balance was present instead (Protos)
• Wallet rotation described as evading static-list screening — TRM Labs; HTX calls it security practice

The real-world read

HTX's disclosure has moved backwards. Its earlier tooling let outsiders check which addresses held what; the current report substitutes an unnamed counterparty and an instruction to contact a custodian it won't identify — a verification path that cannot be walked. The STEAK-USDC error matters beyond the label: a reserves report that misstates what it holds is weak evidence for anything it asserts.

The two framings sit badly together. HTX says fast wallet turnover is security hygiene; TRM — a commercial compliance vendor, so an interested reader of its own product's blind spots — says it looks like screening evasion. Nothing here proves customer funds are missing, and the assets Protos traced are still visible on-chain. What's conspicuously absent is HTX's side: it did not reply, and no one has explained why a sanctioned exchange's reserves would route through a sister exchange's hot wallets.

Opinion, and whose

• Redboard (TRM): the wallet churn is an attempt to outrun static-list screening. That is TRM's interpretation, not an established finding.
• Protos: the related-party flows "raise serious questions" about internal controls at both Sun-owned exchanges and Poloniex's dealings with a sanctioned entity — a conclusion, not a regulatory determination.
• HTX: the practice is normal cybersecurity. Unaccompanied by evidence, and unrepeated since.

Sources

• Protos (13 Aug 2026), "We found HTX's reserves at Poloniex" — the sole account of the transfers, address-by-address; secondary reporting resting on Etherscan wallet labels, HTX's own proof-of-reserves reports, and TRM Labs. Independent investigation, not sponsored.
• HTX proof-of-reserves reports (May and June) — cited via Protos for the "ThirdParty" line, the $1.3bn figure and the STEAK-USDC discrepancy. Issuer-produced.
• TRM Labs report — wallet-rotation findings and the Redboard quote, cited via Protos; TRM sells screening tools.
• EU Council; UK FCDO — sanctions designations, referenced via Protos; the underlying notices were not reviewed here.

Not financial advice. On-chain address labels are third-party attributions and can be wrong.