The stETH Pipeline: How HTX's Proof of Reserves Leaked into Poloniex's Basement

Over the past seven days, I kept staring at one address: 0x176F3DAb24a159341c0509bB36B833E7fdd0a132. Etherscan labeled it "Poloniex 9." But a month earlier, the same address carried another label: "Justin Sun 4." Labels are not law. But when the proof-of-reserves wallet of HTX — formerly Huobi — begins feeding 71,853.22 stETH through a chain of addresses that ends in a Justin Sun-related label, the law of conservation of trust starts to break. Here is what happened: On May 1, HTX's published proof-of-reserves showed the address 0x18709e89bd403f470088abdacebe86cc60dda12e holding 71,853.22 stETH, worth roughly $135 million. On May 30, that stETH moved. Not to a cold wallet. Not to an independent custodian. It flowed through an intermediary address, then into addresses Etherscan tagged as "Poloniex 7," "Poloniex 10," and finally "Poloniex 9" — the same address once known as "Justin Sun 4." In a normal world, an exchange moving user assets between wallets is routine. In a world after FTX, it is a scream. We have learned that the distance between a proof-of-reserves page and actual segregated customer funds can be the distance between a marketing PDF and a criminal indictment. Every scar in the market teaches a new rule. The rule here is simple: if the token leaves the wallet that was used to prove solvency, the proof is dead. I have been auditing crypto projects since 2017, when I spent six weeks inspecting a Golem smart contract before putting my own savings into the token. That experience taught me to treat labels, hype, and even Etherscan tags with forensic suspicion. So when I saw this transfer path, I did not just screenshot it and move on. I traced every hop. I checked the intermediate address. I looked at historical tags. And I found a pattern that should unsettle anyone who still keeps funds on HTX. The Context: How Proof of Reserves Became a Theater Let me back up. HTX was once Huobi, one of the oldest exchanges in crypto. After Justin Sun's takeover, the brand changed, but the underlying structure became even more opaque. In the wake of FTX, exchanges rushed to publish proof-of-reserves reports. The idea was noble: demonstrate that customer assets exist on-chain, backed by addresses the exchange controls. Real implementations use Merkle trees, signed addresses, and independent auditors. Some exchanges even went further, publishing full cold wallet inventories. HTX did something different. Its reserve report started listing a category called "ThirdParty." Instead of showing exactly which wallet held what, HTX told users: trust us, some of your assets are with an unnamed third party. That is not proof of reserves. That is proof of absence. The stETH transfer I traced makes it worse. The asset that HTX reported as part of its reserves was moved into wallets labeled as belonging to Poloniex, another exchange under the same controlling person. If the "third party" is an affiliated exchange, then the reserve is not a reserve at all. It is an internal transfer between two drawers of the same desk. Let me explain why this matters. A solvent exchange needs to own enough liquid assets to cover user claims. The assets should be segregated, controlled by the exchange but not commingled with operational funds. When an exchange transfers user assets to a related entity, the segregation collapses. The user's claim no longer stands behind a specific, auditable wallet. It stands behind a promise that the related entity will act honestly. In crypto, that promise has historically been worth less than the paper it is printed on. TRM Labs, a blockchain intelligence firm, has also raised flags. According to prior reporting, TRM found that HTX engaged in "rapid address rotation to stay ahead of screening" after sanctions were applied. Address rotation can be a legitimate security practice. But when an exchange rotates addresses immediately after being sanctioned, and when those addresses then appear under another exchange's name, the most plausible explanation is not security. It is visibility reduction. The exchange wants to move funds without leaving an easy trail for sanctions compliance teams. Trust is the only asset that survives the crash. When an exchange actively obscures its reserve addresses, it is not protecting users. It is protecting itself from scrutiny. The Core: Following the stETH Through the Looking Glass Let me walk you through the exact path, because this is where the technical analysis begins. Source address: 0x18709e89bd403f470088abdacebe86cc60dda12e On May 1, this address held 71,853.22 stETH. That amount was disclosed in HTX's proof-of-reserves report. This was the address that supposedly underpinned part of HTX's liabilities. First hop: 0x7C103bbAE0DA51AE929dE97A98633668ddE80d04 This is an intermediate address. Intermediary addresses are not inherently suspicious. But they become suspicious when the final destination is a related party. Why use a middle hop to move reserves? If your goal is transparency, you don't need a middle hop. If your goal is to obfuscate the trail, you absolutely do. Second hop: 0x8FCA4adE3a517133fF23ca55CdAea29C78C990b8 Etherscan tags this as "Poloniex 7." At this point, the funds have moved from an HTX reserve address into a Poloniex-controlled cluster. Third hop: 0x29065a4C1f2F20d1E263930088890d6F49Fe715a Tagged "Poloniex 10." This is not a random hot wallet. It is part of a cluster of addresses that Etherscan has identified as belonging to Poloniex. Fourth hop: 0x176F3DAb24a159341c0509bB36B833E7fdd0a132 Tagged "Poloniex 9." But before that, this exact address was tagged "Justin Sun 4." That single detail transformed the whole chain from a routine internal rebalancing into a governance red flag. What does this tell us? In blockchain forensics, address labels are not definitive proof. A label can be wrong, or outdated, or deliberately misleading. But when multiple independent labels converge on the same control person — Justin Sun — the statistical likelihood of coincidence drops to near zero. The flow is not just HTX to Poloniex. It is HTX to the controlling person's network. From a risk perspective, that means HTX and Poloniex might as well share one balance sheet. The deeper problem is that HTX has not explained any of this. When Protos reached out for comment, HTX did not respond to the key questions. Poloniex declined to disclose the addresses. That silence is itself a data point. In my experience, exchanges that are doing the right thing do not stay silent when someone asks, "Why did the assets from your reserve wallet move to a related party?" They issue a blog post. They share a signed message. They do not refuse. Let me also address the Bitcoin side of the reserve. According to the reporting, more than half of the Bitcoin HTX claims to hold is not native BTC at all. It is tokenized Bitcoin. Now, tokenized BTC can be legitimate. Wrapped Bitcoin on Ethereum has been around for years. But the quality of a reserve asset depends on the issuer. If the tokenized Bitcoin is issued by an independent, well-capitalized custodian and held in a wallet controlled by the exchange, that is one thing. If it is issued by a related entity and held on a related exchange, then the "Bitcoin reserve" becomes a claim on an IOU from the same person who runs the exchange. That is not a reserve. That is vertical integration without accountability. I have a term for this: shadow custody. The exchange reports a healthy reserve number, but the underlying assets are sitting in affiliated wallets, layered with IOUs, and subject to the same governance risk as the exchange itself. This is not a technical innovation. It is a structural regression. A proper proof of reserves should include: a Merkle tree snapshot of liabilities, a list of addresses with verified signatures, independent auditor involvement, and a clear legal commitment that those addresses are controlled by the exchange and not pledged to anyone else. HTX's "ThirdParty" bucket fails every one of these tests. The Contrarian Angle: What the Market Is Missing You might be thinking: "Mia, this is just another exchange transparency story. We already know centralized exchanges are black boxes." But there is a more uncomfortable angle here that most analysts are missing. The conventional narrative treats this as a story about HTX's solvency. It is not. It is a story about regulatory arbitrage through organizational design. Justin Sun controls HTX, Poloniex, and the intermediary addresses. When user assets move from one controlled entity to another, the exchange can choose which entity eventually faces the liability. If Poloniex holds the tokens, and a regulator freezes Poloniex, HTX can say: "The assets are not in our wallet anymore." If HTX comes under pressure, the assets are safe inside Poloniex. This is not just opacity. It is a legal firewall constructed out of user deposits. That insight matters because it means the risk is not simply "HTX might be insolvent." The risk is that user assets could be trapped in whichever entity the controlling person prefers at any given moment. You cannot prove your claim because the asset is not under the entity you have a contract with. It is under a sibling entity in the same corporate family. In a bankruptcy scenario, that is a disaster. I also want to challenge the idea that stETH is a safe reserve asset for an exchange. stETH is a liquid staking derivative. It is not the same as ETH. Under normal conditions, it is redeemable, but redemption can be gated during market stress. If the exchange's entire reserve is stETH, and the exchange needs to process withdrawals at the same time that stETH redemption queues are long, the reserve loses its liquidity at the exact moment it is needed. That is a classic liquidity mismatch. Now combine that with the fact that this stETH was moved to an affiliated exchange, and you have a double fragility: asset liquidity risk plus counterparty concentration risk. The retail crowd usually reacts to stories like this by checking the price of HTX's exchange token. That is a mistake. The price of HTX token already embeds a discount for governance risk, but it does not embed the tail risk of asset seizure or a prolonged withdrawal freeze. When FTX collapsed, FTT price was not the best indicator of insolvency. The on-chain movement of assets was. We should not repeat that mistake. Let me also address a common defense: "Address labels are not reliable." That is true. But the burden of proof has shifted. When an exchange publicly discloses a reserve wallet, and that wallet's assets move to a related-party cluster, the exchange has an obligation to explain the flow. Silence is a choice. In a court of law, silence can be construed as admission. In the court of public trust, it is worse. I have sat through too many post-mortem calls after crashes. I remember the Curve pool incident in 2020, when we had to pull 85% of our community's capital out before an oracle manipulation fully played out. The lesson from that scar was: when the numbers on the page do not match the movement on-chain, you run first and ask questions later. That lesson applies to HTX today. The on-chain movement contradicts the proof-of-reserves page. The exact match is gone. We walk away from greed, we stay for trust. And trust, right now, is telling us to exit the building. The Takeaway: What Users Should Do with This Information Let me be clear about what this analysis does and does not prove. It does not prove that HTX is insolvent. It does not prove that Poloniex has stolen user funds. It proves that the legal and operational separation between HTX and Poloniex is effectively cosmetic. It proves that the proof-of-reserves mechanism HTX uses is incapable of demonstrating solvency to an external observer. It proves that more than half of HTX's reported Bitcoin is not native Bitcoin and is likely held by a related exchange. And it proves that the controlling person has both the incentive and the technical ability to move user assets between entities with minimal external visibility. For users, the actionable takeaway is simple: do not keep assets on an exchange that hides reserve assets in a "ThirdParty" category. Do not accept a proof-of-reserves report that does not name the wallet and the custodian. Do not wait for a crisis to start asking questions. The moment an exchange changes its reserve disclosure to include unnamed third parties, that is the moment your counterparty risk doubles. I also want to give a forward-looking thought. In 2025, we saw Bitcoin ETFs become mainstream, and I worked with Nigerian banks to build a bridge between retail users and institutional execution. That experience showed me that regulation can be a shield, not just a cage. The next phase of crypto will be built on verifiable custody. Exchanges that refuse to provide it will either be regulated into oblivion or left behind by users who have learned the lesson of FTX, and now HTX. The question I keep asking myself is not whether HTX will survive. The question is whether the industry has the courage to stop accepting these shell-games as normal. Transparency is the shield against the next bubble. It is also the only way to protect the flock, not just the profits. I do not know the exact intentions of the people behind this stETH pipeline. I do not know whether this is negligence, willful opacity, or something worse. What I know is that the chain of custody is broken. When the chain of custody is broken, the only rational response is to assume the worst and demand better. Every scar in the market teaches a new rule. The rule today is: if you cannot see the asset, it is not your asset. And if the exchange calls its own shadow a third party, run. This article is not investment advice. It is a warning built on public data, forensic practice, and the painful memory of every user who trusted a balance sheet over a blockchain. Trust is the only asset that survives the crash. Let us make sure we are putting our trust in something that actually exists on-chain, in an address we can verify, under a custodian we can name. The stETH pipeline is a symptom. The disease is unaccountable control. We can treat the symptom by withdrawing funds. We can cure the disease by demanding proof, not promises. I know which one I am choosing.