- Justin Sun rejected the HTX dusting reports as fabricated.
- HTX Head of Markets Liu Ye confirmed an internal investigation into the same transfers.
- An on-chain check found the transfers went to Kraken addresses, not Coinbase as alleged.
- The EU transaction ban on HTX takes effect August 23.
Justin Sun spent August 18 telling anyone who would listen that the reports were made up. Traders had been posting screenshots all day of USDT deposits between $7.5 and $12 arriving from wallets that explorers tagged as HTX, followed by claims of account restrictions at the exchanges where those deposits landed, and the TRON founder’s response on X was that the investigation was clear and the whole thing was fabricated. An independent on-chain check later supported him on the central detail. Later the same day, HTX Head of Markets Liu Ye acknowledged the community’s alarm and confirmed the exchange had opened a formal internal investigation into the tainted transactions. Companies do not investigate events they have established did not occur. The gap between those two statements is the most revealing thing HTX produced this week, and it arrived five days before the European Union’s transaction ban on the exchange takes effect.
Sun answered a question nobody asked him
Read the denial closely and it addresses authorship, not consequence. Sun’s claim is that HTX did not send the money. Liu Ye’s investigation addresses whether the transfers happened and what they did to users, which is a separate matter entirely and one the on-chain record already settles.
Both positions can hold simultaneously, which is what makes the episode awkward rather than dishonest. The exchange’s own statement carries the tension in a single breath: official channels initiated no transfers or testing activity, and verification continues into possibilities including address tagging and on-chain source identification. HTX added a point that is technically sound – explorers and analytics firms assign labels through ownership declarations and clustering, and a visible label proves nothing about who authorised a payment. The statement named no blockchain, no sending addresses and no transaction hashes.
Why a label can lie about who sent the money
Forensic platforms including Chainalysis and TRM Labs receive no wallet list from exchanges. They infer ownership from behavior – gas pricing, batching cadence, which deposit nodes an address communicates with, how balances get consolidated. Behavior can be copied. An attacker who studies HTX’s operational fingerprint and reproduces it may get folded into the exchange’s cluster by the algorithm, after which the label spreads to every explorer and compliance dashboard consuming that feed.
Reports named a specific cluster carrying the designation HTX48, which at least gives the claim something inspectable.
The transaction shape argues against exchange origin. Withdrawals follow user demand and produce irregular amounts at irregular intervals. What analysts observed was repeated $3 to $10 transfers hitting unrelated wallets in tightly grouped windows. That is a loop.
The reports are fabricated. HTX sent nothing.
A formal internal investigation is open.
The Coinbase account nobody can find
Compliance software assigns risk by association. When a regulator designates an entity, intelligence providers recluster everything linked to it, and addresses clean on Monday turn red on Tuesday without their owners acting. That mechanism is real, which is why the story travelled so fast. Whether it happened here is another matter.
The originating claim came from pseudonymous trader 0xZiye, who said a $7.5 USDT deposit prompted Coinbase to demand a source-of-funds explanation with account termination on the table. Community researcher 0xMoon went looking for the transaction. HTX said it could not trace the transfer because 0xZiye had declined to supply his deposit address, citing privacy, so 0xMoon examined HTX hot wallet 48 directly and found the $7.5 transfers had gone exclusively to Kraken addresses. Nothing reached a Coinbase account. No second affected user surfaced either, which is difficult to square with a systemic freeze wave.
Sun endorsed those findings. 0xMoon was more measured, noting the original deposit address would resolve the remaining gap. It has not been provided.
The precedent people reach for offers less cover than they assume. After OFAC sanctioned Tornado Cash in 2022, activists dusted high-profile wallets including Jimmy Fallon’s with tainted ETH, and OFAC’s subsequent guidance stated that its regulations technically do reach those recipients, who are expected to file a blocked property report and may need a licence to move the funds. The concession was narrower: the agency said it would not prioritise enforcement over delayed reporting where no other sanctions nexus existed. Enforcement discretion is not a finding of innocence, and it binds only the regulator. Coinbase remains a private business free to refuse anyone whose file raises its own exposure.
The corporate argument HTX is really making
Behind the denial sits a jurisdictional claim. HTX contends that the UK designated Huobi Global S.A., a legal entity it treats as distinct from the retail platform its customers use daily. Regulators have shown no interest in that separation, and the EU measure arriving Monday does not carve it out.
After that date the discretion currently available to compliance officers narrows. A flagged deposit today produces a questionnaire. Inside the EU next week it produces a rule violation, and the officer reading the file has less room to exercise judgment. Sun has told users the Binance restrictions reach only UK and EU customers, an account drawn from his own conversations with the exchange rather than from anything Binance published. Anyone holding a balance there faces a narrow window, and where those funds land afterwards – an exchange account or a wallet under their own keys – decides who fields the compliance question that follows a USDT transfer.
The wider dusting pattern predates this week’s dispute and remains unexplained. Nobody has traced how the wallets behind it were funded. Whoever ran the script paid gas for thousands of transfers, and a competitor damaging HTX’s remaining relationships, a group testing how fast Western AML infrastructure can be turned against ordinary wallets, and a scam operation harvesting live addresses all fit the observed footprint equally. Following the original deposits into those funding wallets would separate the three. No firm has published that work.
