Top Exchange Reserves Check · 2026-10

Each table heading carries its own read time. Every number can be re-read with tools/cex_reserves_verify.py in this repository; the output snapshot is data/cex_reserves_2026-10-19.json. Source discipline: direct on-chain read > official PoR page > public aggregator > media. The first three go into tables; media is used only as a lead, marked ⚠, and never tabulated. This page makes no judgement about any exchange's solvency; it presents verifiable facts and the differences between sources. Not investment advice.

0. Summary

1. The distribution: of the 20 exchanges, 18 hold under 20% of reserves in affiliated tokens, and only two are above 30% — the highest at 78%, the next at 32%. Eight hold none at all; across the twelve that do, the median is 13% (⚠ caliber: counting the eight zeros as well, the median across all 20 is 2.5% — the two medians are not the same thing, and a citation must say which). Exchange by exchange in §4.2.
2. Among top exchanges, HTX is the only one holding all four kinds of affiliated assets: a platform token (HTX token), an affiliated stablecoin (USDD), self-issued wrapped coins (BTC-TRC20, HBTC), and JustLend yield receipts (stUSDT/jUSDD). Every other exchange has at most one kind (classification and the three FTX criteria in §4).
3. HTX reports reserve ratios "all above 100%", but on the on-chain-verifiable basis: own-wallet USDT covers only 4.8% of liabilities, BTC 42%, ETH 25%; 18.1% of total reserves sit with an undisclosed "third-party custodian", and 47.5% is TRX, 69% of which is staked. (self-reported figures are the 2026-09-01 page snapshot; on-chain figures are direct reads of 09-14)
4. BTC chain (11 exchanges): 10 reconcile within ≤0.2% between the direct read and the aggregator (Binance / Bitfinex / Bybit / Gate / Bitget / MEXC / Gemini / Deribit / Crypto.com / Bitstamp); the exception is HTX at +0.9% (list basis, §3.1). Binance's official PoR address endpoint is unchanged at 64 BTC / 37 ETH addresses (matching the local list; one of the 38 ETH entries is a duplicate); Bitstamp's website list changed sharply again: 502 → 561 addresses (updated Oct 17; 289 added, 230 removed, 272 present both weeks; over five weeks 507 → 196 → 229 → 502 → 561); on the current list the direct read is 39,526 BTC and the aggregator, which follows the same list, shows 39,546 (−0.1%). ETH-chain coverage: Binance 100%, Bitfinex 102%, Gemini 102%, KuCoin 101%, OKX 97%, Gate 124%, HTX 122%, Bitget 75%, Bitstamp 48%* (>100% means the direct read exceeds the aggregator; caliber differences in the §3 table notes). Every exchange self-reports reserve ratios above 100%; this report can verify only the part readable on chain, and §3 shows how much that is for each exchange.
5. This week's changes (in coin units, same address list before and after; Oct 12 → Oct 19; over the same period Binance BTC −2.0%, ETH −5.0%): BTC Binance +6,729 (+1.1%, 64-address basis), Deribit +541 (+1.3%), Gate +430 (+2.3%), Bybit +301; Bitget −474 (−1.6%), Bitfinex −276, Gemini −275, Crypto.com −132; Bitstamp −2,280 (−6.7%) on the 272 addresses present both weeks, but +117 (+0.3%) in total on the current 561-address list — the gap is wallet rotation: the 230 removed addresses are now empty (about 5,325 BTC on Oct 12) and the 289 added ones hold 7,722 BTC (§2 note). Native ETH on Ethereum mainnet: Bitfinex +58,198 (+10.9%; over the same week its Ethereum USDT +$212M, LEO +$79M, USDF +$75M), OKX −42,663 (−3.8%), Gate +15,193 (+9.2%), Binance +12,868 (+0.4%; WBETH −$570M over the same week), Bitstamp −1,955, Gemini −1,440. Stablecoins: Bitget USDT-TRC20 −88.9M and Ethereum USDT +38.2M; Gate Ethereum USDT +83.2M, TRC20 +50.0M; Binance USDT-TRC20 +51.4M, Ethereum USD1 −131.0M / RLUSD +115.5M / USDC −90.1M; KuCoin Ethereum USDT +47.6M; OKX Ethereum USDT +40.9M / USDC +40.3M. ⚠ Dollar figures are distorted by price (Binance's Ethereum ETH −$359M in dollars but +12,868 in coins); this item uses coin counts throughout.
6. Bitget incident (public record): at 18:31 UTC on 2026-09-24 Bitget announced abnormal outflows from hot/warm wallets, with an initial official estimate of about $351.6M, and suspended all withdrawals (CEO post on X: https://x.com/GracyBitget/status/2103235655879074084). The part verifiable on chain: one receiving address, 0x770b10b273fc44fe9197d6bf20f145c2e98463ee, took about $173M from Bitget's published addresses (Ethereum ETH 24,595 / USDT 34.75M / USDC 12.85M / XAUT 3,000 oz; Arbitrum USDT0 19.67M; Avalanche AVAX 821,012 + USDC 8.2M; BSC BNB 12,719); no outflows to the same destination were seen from the published Tron or BTC addresses. This week Bitget's Ethereum-mainnet ETH fell 18,221, USDT 154.5M and USDC 8.8M; all three source addresses are on this report's list. Net of those outflows, ETH (+6,374) and USDC (+4.1M) rose, while USDT still fell by about 120M. This row's decline this week is not to be read as ordinary fund flow; this report does not characterise the incident or attribute the outflows. Follow-up (public record): Bitget announced on X that the vulnerability "has been identified and remediated" and that withdrawals would resume in phases (https://x.com/bitget/status/2103695497458557342); per reports, BTC withdrawals resumed at 08:00 UTC on Sep 28, ETH on Sep 29, USDT on Sep 30, with other tokens, fiat and P2P set for Oct 2; reported losses were updated to about $387.5M ⚠ (media figure; no official itemisation seen). Bitget's BTC direct read fell 6,165 this week, in line with the 29,100 BTC wallet figure in its Sep 29 official PoR (§3.1: direct read 29,247, +0.5%); this report does not characterise the incident or attribute the outflows.

1. Method: three data layers, trust only the bottom one

Aggregator caliber rules

1. Platform tokens are counted; stablecoins issued or affiliated with the exchange (USDD), self-issued wrapped coins (HBTC / BTCTRON) and Aave deposit receipts are not.
2. The Binance row includes the collateral it locks for BSC pegged tokens ($12.3B), which is not customer assets.
3. Address sets may differ from official PoR lists (HTX: 57 DefiLlama-Adapters addresses vs 11 official).

2. Panorama: top 20 by on-chain reserves (DefiLlama public-address basis, read 2026-09-14 01:08 UTC)

Sample rule: the top 20 by on-chain assets on the DefiLlama CEX board, no discretionary additions or removals; Coinbase / Kraken / Upbit publish no addresses and are not on the board.

• Self-check entry points: the board https://defillama.com/cexs; per-exchange pages https://defillama.com/cex/<slug> (e.g. https://defillama.com/cex/htx, https://defillama.com/cex/binance-cex); the API https://api.llama.fi/protocol/<slug> (per-chain currentChainTvls and token breakdown); DefiLlama-Adapters source https://github.com/DefiLlama/DefiLlama-Adapters/tree/main/projects (address lists or fetch logic live there).

• "Affiliated token" = an asset issued by the exchange or its controller; the uniform red rule is affiliated tokens >30% of reserves.

• "1-year net flow" = the residual change in reserves after removing price effects (positive = net inflow); price baseline from Binance daily closes: BTC −28.0%, ETH −42.9%, stablecoins 0, affiliated/other ≈ −40%.
• ⚠ The Bitstamp row is the aggregator's read. Bitstamp's published address list (wallet_transparency, updated Oct 17) changed this week from 502 to 561 addresses (289 added, 230 removed, 272 present both weeks; the full sets match under perPage 100 and 50) — over five weeks the list has gone 507 → 196 → 229 → 502 → 561. This report's read on 2026-10-19 against the current list is 39,526 BTC (561 addresses, 0 failures; aggregator 39,546, −0.1%, the aggregator also follows the website list), +117 (+0.3%) on last week's 39,410 on the old list; on the 272 addresses present both weeks: 34,084 → 31,805, −2,280 (−6.7%); the 230 removed addresses are now empty (about 5,325 BTC on Oct 12) and the 289 added ones hold 7,722 BTC. ⇒ Coins moved from old addresses to new ones and the exchange's total is essentially unchanged; the fall on the addresses present both weeks is one half of a rotation, not an outflow; this report makes no inference about why the list changed.

How to read

• Only two exchanges hold more than 30% of reserves in affiliated tokens: HTX 78%, Bitfinex 32%. LEO is the platform token iFinex issued in 2019 (not a stablecoin; supported by revenue buybacks and burns), in the same class as BNB, OKB, GT and KCS, and flagged by the same rule.
• The remaining 61% of Bitfinex is BTC.
• Bitstamp +121.3% is not an inflow: the aggregator DefiLlama-Adapters's pagination bug was fixed and its address set completed (DefiLlama-Adapters PR #20878, merged 09-04); its BTC read went from 4,180 to 40,167.
• Poloniex +61.1% is not customer inflow: between 2026-05-30 and 06-04, 71,993 stETH, 806M sUSDS and 1,723 WBTC entered Poloniex 9 (the address holding 63% of its reserves) through two Poloniex-published addresses. The stETH leg traces back to HTX address 0x18709E89… (attribution verified in §7); the 1,723 WBTC and 200M of the sUSDS trace to the same address; the other 606M sUSDS comes from an unlabelled hub that mints sUSDS itself, and its HTX origin could not be established on chain. Hop by hop in §7.
• The rest of HTX is 18% BTC (half of it the BTC-TRC20 of §7.2) and 2% ETH; there are no stablecoins on the aggregator's address set. Gemini, Bitstamp and Robinhood are also at 0% stablecoins, which is not a discrepancy in itself; the read of own-wallet USDT on HTX's official PoR list is in §6.2.

3. Direct on-chain reconciliation of published addresses (primary evidence)

§2 is the aggregator's basis; this section is this report reading the chains itself: take each exchange's published addresses (official PoR list or DefiLlama-Adapters source, see tools/cex_addresses.json), read BTC / all ETH assets / Tron per address, then reconcile against the aggregator. Tables are generated by tools/make_tables.py from data/cex_reserves_2026-10-12.json; every address's read and failure record is in that file.

3.1 BTC chain (mempool.space direct read vs aggregator; difference ≤1% green, >5% red)

How to read

• Ten reconcile within ≤0.2%, HTX at +0.9%; the aggregator's BTC figures can be cited directly. Binance's official address endpoint matches the local list this week (64 addresses); Bitstamp moved to the 561 addresses on its website list (on last week's 502-address list this report would read 31,805 BTC, 20% below the aggregator).
• The aggregator BTC column converts the aggregator's dollars back to coins with a price. That price used to be inferred from the Binance row alone, so any mismatch between Binance's list and the aggregator's shifted every other exchange (+1.7% this week before the sync); from Sep 28 it is the median of the prices inferred across exchanges.
• The HTX row is the DefiLlama-Adapters's 11-address list; its official PoR list has 7 addresses holding 7,884 BTC on chain (§6.2).
• The Gate list once contained 3 strings starting with 3P that returned 404 on both BTC explorers; decoded, they are not Bitcoin addresses (35 characters, checksum fails) but Waves-chain addresses from the waves section of the DefiLlama-Adapters (Waves mainnet addresses happen to start with 3P), mis-sorted into BTC by prefix when this report extracted them. They are removed, and the script now validates addresses.
• The last two columns: each exchange's self-reported BTC from its official PoR page (user liabilities / exchange wallets incl. custody; fetched by tools/por_fetch.py, Binance and Bybit entered manually), and the direct read's difference from the reported wallets (percent). Differences over 5% are red with the reason: they come from snapshot dates, address sets (the DefiLlama-Adapters address list is not every wallet on the page) and caliber (HTX counts BTC-TRC20 and custody as wallets), and are not a reserve-check criterion. OKX (139,865 / 153,151, Sep) and KuCoin (7,359 / 7,994, 09-30) self-report BTC but publish no BTC addresses, so they are not in the table. Bitfinex, Gemini and Bitstamp have no Merkle PoR page and report no per-coin figures; Deribit stopped publishing PoR on 2026-09-01 (90% of client assets moved to Coinbase custody); Crypto.com has a page but its figures are script-rendered and no snapshot has been taken yet.

3.2 ETH chain (Blockscout all-asset direct read vs aggregator; the "aggregator-caliber" column excludes USDD/HBTC/aEthUSDT; coverage 95–105% green, <90% or >110% red)

How to read

• Five exchanges at 97–102% (Binance / OKX / Bitfinex / Gemini / KuCoin); the aggregator can be cited. HTX 122% is covered below; Gate 124% (120% last week) reads $4.14B against the aggregator's $3.33B, about $0.81B above — this week the row moved Ethereum USDT +$83M, GHO +$54M, USDS +$36M, GT −$116M and AAVE −$62M — and the composition of the gap is still unverified ⚠; Bitget 75% (below 80% for a third week; direct $0.97B vs aggregator $1.29B), composition unverified ⚠. Bitstamp is noted separately.
• HTX's all-asset read of $0.20B exceeds the aggregator's $0.13B; after removing exchange-issued or affiliated assets (USDD $44.8M + HBTC $1.5M, §1 rules) the same-caliber read is $0.15B, still 122%, and the remaining ~$28M gap is unverified ⚠. Correction: this item previously said "the gap is exactly USDD $45M + HBTC $42M; 108% on the same caliber". The HBTC $42M was a September figure; from the Oct 5 snapshot onward HBTC was only $1.5–2.9M, so that sentence had been stale since Oct 5.
• The Bitget row's fall in ETH and stablecoins on Sep 28 includes the outflows from its published addresses in the Sep 24 incident (§0 item 6, public record); Sep 28 → Oct 12 was the withdrawal-resumption period; this week (Oct 12 → Oct 19) native ETH is +13, essentially flat, with Ethereum USDT +$38M and TRC20 USDT −$89M.
• * Bitstamp 48%: a caliber difference, not an address difference. DefiLlama counts all Beacon-chain staked ETH whose withdrawal credentials point to Bitstamp addresses (≈233k ETH, 8,011 validators) as Bitstamp reserves; this report does not, because staked ETH sits on no published address's balance, and two of the four withdrawal addresses are not on Bitstamp's published list, so the attribution rests on the aggregator's own address table alone. Adding that part back, the two sides reconcile. Independent check: tools/beacon_validators.py (§9).
• The Binance row includes 2 pegged-token lock addresses ($12.3B), not customer assets. "Pegged-token lock" means the native collateral Binance locks on Ethereum mainnet for the Binance-Peg tokens it issues on BNB Chain (BSC versions of USDT, USDC, ETH, etc.); the liability side is the holders of those pegged tokens, not exchange customers. The addresses come from Binance's lockinfo endpoint and are not on its PoR list; a proposal to split them out has been filed with the aggregator (DefiLlama-Adapters PR #20885, closed unmerged by maintainers).
• "Failed addresses" are all 0 (one OKX address cleared after a retry).
• The last column is each exchange's self-reported ETH (users / wallets, snapshot dates vary). Its caliber is ETH across all chains (L2s, staking receipts and custody included), not the same as this table's Ethereum-mainnet dollar read, so it is shown for reference only and no difference is computed.
• The added "Direct native ETH" column counts only native ETH on Ethereum-mainnet addresses (no stETH-type receipts, no L2), script tools/eth_native_units.py, read 09-05; the PoR ETH wallet figure is all-chain (L2s, staking receipts and custody included), so "Direct native − PoR wallets" is generally negative, shown for reference only and not judged by the §3.1 red rule. Example: of HTX's reported 116,757 wallet ETH (09-01), 87,525 is custody and 29,158 stETH, with only 1,504 native mainnet ETH (its GitHub snapshot CSV), the same order as the 11,118 read directly; Binance −18% and OKX −42% mostly reflect multi-chain pages and differing address sets.

3.3 Tron chain (trongrid getaccount with four staking buckets + direct USDT-TRC20 read)

How to read

• The aggregator cannot be cited here. It misses USDT-TRC20 (Bitget's published addresses held 221M on Oct 19, the aggregator records 0), and its eth_getBalance read excludes staked TRX.
• Tron's "freeze" is its official term for staking TRX with the network in exchange for bandwidth, energy and votes: ownership is unchanged, unstaking can be started at any time and lands 14 days later; it is neither loan collateral nor a platform or judicial freeze. This report says "staked" throughout. Staked TRX can be in four places: V1 stake, V2 self-held stake, stake delegated to other addresses (the TRX still belongs to the address), and the unstaking queue; the "TRX staked" column counts all four. OKX's 485M and Poloniex's 24M are delegated stake, invisible if you only read balance + frozenV2 (§7.1).
• HTX's 18 Tron addresses in the table are the DefiLlama-Adapters's TRX cold wallets; holding no USDT there is normal. HTX's official PoR has 5 separate USDT-TRC20 addresses: 13.24M in the 08-01 snapshot, 1.91M on chain on 09-14 (below 1% of the user USDT liability, the §10 rule; the 11.33M on TK86… has been emptied); the single USDT-ERC20 address went 1.05M → 0. The rest of the 926M user USDT liability sits in "ThirdParty" (§6.2).
• The last two columns are each exchange's self-reported TRX and USDT (users / wallets); USDT is the all-chain total (ERC20 + TRC20 + others) while this table's USDT-TRC20 is one chain, so no difference is computed. HTX's reported TRX wallets of 9,384M (09-01) are in the same range as this table's 9,747M across 18 addresses (available + staked, 09-14); of its reported 588M USDT wallets, 547M sit in "ThirdParty" (93%, §6.2).
• "Direct TRX − PoR wallets": direct TRX (available + staked) and the reported TRX wallet are the same chain and caliber, so they compare directly; over 5% is red with the reason, as in §3.1. Gate −45.9% is an address-set difference (the 11-address DefiLlama-Adapters list; Gate publishes no TRX addresses); HTX +4.2%. No difference is computed for USDT because the reported figure is all-chain.

4. Affiliated tokens as a share of reserves: FTX's three structural preconditions, exchange by exchange

4.1 What FTX's structural preconditions were (⚠ public reporting, used only as the source of the criteria)

FTX's balance-sheet structure before its November 2022 collapse is where this chapter's criteria come from. Note: FTX the exchange never published its own reserve composition; the criteria here come from the balance sheet of its affiliated market maker Alameda, which is not the same basis as the exchange reserve shares in §2 and cannot be compared with them directly. Three points:

• Its own token was the bulk of assets: on 2022-11-02 CoinDesk published the balance sheet of Alameda, FTX's affiliated market maker: of $14.6B in assets, $3.66B was FTX's platform token FTT and another $2.16B was "FTT collateral"; FTT-related items exceeded a third of assets (https://www.coindesk.com/business/2022/11/02/divisions-in-sam-bankman-frieds-crypto-empire-blur-on-his-trading-titan-alamedas-balance-sheet).
• Its own token had no order book: most of the FTT float sat with FTX and Alameda themselves; market cap was list price times quantity, not money that could be realised. On 11-06 Binance announced it would sell its FTT, and FTT lost 80% over the next three days.
• The liability side was opaque: customer deposits had been diverted to Alameda, and outsiders could not see how liabilities matched assets; withdrawals were halted on 11-08 and bankruptcy filed on 11-11.

The criterion: what is fatal is not "holding your own token", it is all three at once — ① the own token is the bulk of reserves; ② the own token has no order book; ③ the liability side is opaque. Below, every exchange is checked against the same rules.

4.2 By exchange: affiliated tokens as a share of reserves (data as in §2; red rule as in §2: affiliated >30% of reserves)

"Hard assets" = BTC + ETH + stablecoins; whatever the two columns leave short of 100% is other coins (SOL, XRP, etc.).

• Two exchanges are above 30%: HTX 78%, Bitfinex 32%. The difference is in hard assets: Bitfinex holds 68% hard assets, twice its LEO; HTX holds 18%, with affiliated tokens more than four times that. Whether affiliated tokens exceed hard assets is the basis of criterion ① in §4.4.
• The table above is on the aggregator's basis (published addresses only, self-issued/affiliated assets excluded). On HTX's own PoR snapshot basis (2026-09-01; §5, §6.2): TRX is 47.5%, HTX token 6.1%, and 51% of the BTC line is the Poloniex-issued BTC-TRC20 (§7).

4.3 Affiliated assets by nature: four kinds

The table above is arranged by exchange; below is arranged by asset, one block per kind. One exchange's affiliated assets can span all four.

① Platform tokens

② Affiliated stablecoin

③ Self-issued wrapped coins

④ Yield / lending receipts

• Only HTX has all four kinds: platform token + affiliated stablecoin + self-issued wrapped coins + yield receipts from an affiliated protocol.
• The aggregator's basis excludes ② and ③, which is exactly the gap between the "aggregator-caliber" and "all-asset" columns for HTX's ETH chain in §3.2.
• Of the four kinds, only the non-affiliated part of ④ (stETH, WBETH, sUSDS, aEthUSDT) is "someone else's credit"; everything else is "own credit".

4.4 The three criteria, exchange by exchange (exchanges with affiliated ≥10%, plus those publishing per-coin liabilities)

How to read

• ① holds for one exchange only.
• ② on its own does not rank danger: days-to-sell runs from a couple of weeks to tens of thousands of days and must be read with ①; the higher the affiliated share and the thinner the volume, the more the reserves shrink once marked to tradable volume.
• ③ Only Binance, OKX and HTX publish per-coin liabilities; the rest either give a single ratio or have no PoR page.
• No exchange in the top 20 meets all three at once; the closest is HTX: ① holds, ② about 45 days to sell (TRX is the most actively traded of these tokens), ③ liabilities are published but a fifth of reserves sit with a custodian not disclosed on the page. The differences from FTX: TRX has a market-wide order book and FTT did not; HTX publishes a liability sheet and FTX did not. The similarity: reserve value is a function of the price of its own family of tokens.

5. Official PoR side by side (each exchange's page, snapshot dates vary — see the first column; red = third-party custody >10% of reserves or own wallets ÷ liabilities <100%, the §10 trigger rules)

• USD values use the Binance close at each snapshot time (OKB at the OKX quote); liabilities and reserves in one snapshot share the same prices, so the ratios do not depend on price. Binance Sep 1 vs Aug 1: user BTC liabilities 656,644 → 682,356 (+25,711), custody share 0.9% → 1.4%, own wallets ÷ liabilities 100.9% → 100.1%. The OKX October edition (no. 48, snapshot Oct 2 16:00 UTC, audit ID 502260945) is read from the data embedded in its official page (22 reserve coins, with liabilities counted over those 22; dollars at the Oct 2 daily OKX quote, ELF has no quote and is excluded); BTC user liabilities 139,865 → 142,810, BTC ratio 109% → 110%. ⚠ The "47 assets" recorded for the previous edition is a different basis from this edition's 22, the source of the difference is unverified, and the two editions' dollar totals should not be differenced directly. No Binance October edition seen as of Oct 19 (this report's fetch is blocked by the page's anti-bot check, so this could not be confirmed directly); the table keeps the Sep 1 edition.
• Correction: this table previously showed Binance Aug 1 as $127.9B liabilities / $130.3B reserves, which left out ETH (about $9.6B). Including ETH at the original Sep 2 prices it is $137.5B / $139.9B; both ratios are unchanged.

6. Discrepancies with self-reported figures (by exchange)

The same reading is applied to every exchange. This section lists the differences between what this report reads and what each exchange reports, each with its verification method; it sets no thresholds, so it uses no colour, only bold for the item.

6.1 Binance / Poloniex

6.2 HTX

Regulatory status (public record; not a reserve-check finding): UK FCDO listed Huobi Global S.A. (alias "HTX (formerly Huobi)") on 2026-05-26, updated 07-07; the EU followed in July, effective 08-23; OFAC has not acted. Source: FCDO sanctions list CSV (primary).

Control group read with the same scripts on the same day

• Binance: 61 BTC addresses, 640,647 BTC on chain (0 failures); 37 ETH addresses $56.4B; USDT-TRC20 897M.
• OKX: 323 ETH addresses $12.9B, 95% of the aggregator (0 failures); USDT-TRC20 273M.

7. Poloniex and BTC-TRC20 (BTCTRON): the Poloniex-linked part of HTX reserves

Poloniex (⚠ public reporting: acquired from Circle in 2019 by an investment group associated with Justin Sun; PoR address list published on GitHub poloniex/tools-nodejs-address-verify, same snapshot block height as HTX):

The HTX → Poloniex fund path (direct on-chain read of Blockscout token transfers; verifiable by address in any explorer)

• stETH: 0x18709E89… (HTX address, attribution below) → 0x7C103bbA… (unlabelled pass-through) → 0x8fCA4adE… (on Poloniex's PoR list) → 0x29065a4C… (Gnosis Safe, on Poloniex's PoR list) → Poloniex 9, 71,993 stETH, all on 2026-05-30.
• sUSDS 200M: on 05-30 from the same HTX address 0x18709E89… → unlabelled pass-through 0x7fed2E5e… → 0x8fCA… → Safe → Poloniex 9.
• WBTC 1,723: on 05-30 from 0x18709E89… → unlabelled pass-through 0xeB245796… → the same path → Poloniex 9.
• sUSDS 606M: on 06-04 from unlabelled pass-through 0x2cf2679A… → 0x8fCA… → Safe → Poloniex 9; upstream of 0x2cf2… is 0x93904eeC…, an unlabelled hub that has minted 1.85B sUSDS from USDS itself since 2026-01; its stablecoin inflows are many-sourced, including small amounts from HTX list address 0xa03400E0… (USDT 50M, USDC 2.5M, DAI 2.7M), with the bulk from a Spark savings vault and other unlabelled addresses. The HTX origin of this leg could not be established on chain.
• Attribution of 0x18709E89… to HTX rests on four independent grounds: ① the huobi entry of DefiLlama-Adapters has listed it as an HTX Ethereum address since 2022-11-13; ② Etherscan-family explorers on other EVM chains (Moonscan, SnowScan) label the same address "Huobi: Recovery"; ③ Hacken's 2023-11 analysis of the Heco bridge incident describes HTX using it to consolidate hot-wallet funds and recovered stolen funds; ④ on-chain behaviour: it sends LINK, ONDO and FLOKI directly to 0x4fb31291…, an address on HTX's official PoR list (2026-07/08), and has over a hundred transfers with HTX list address 0xa03400E0…. It is not among the 11 ETH addresses on HTX's official PoR page.
• Verified: the timing, amounts and path of the three inflows into Poloniex 9; the stETH 71,993, sUSDS 200M and WBTC 1,723 legs all start at HTX address 0x18709E89…. Not established: the HTX origin of the 606M sUSDS (Protos, 2026-08, ⚠ media grade), and whether HTX's "ThirdParty" column includes these assets (HTX does not disclose its custodian). If it does, the same assets appear in both the HTX and Poloniex PoR.

7.1 Poloniex's published TRX addresses: snapshot vs chain, per address (script tools/por_trx_delta.py)

Poloniex's 08-01 snapshot lists 7 TRX addresses (plus 1 sTRX address, which is the TUgSg… among them). Few enough to list one by one; the table is script-generated and can be re-run.

How to read

• Net change over the month −18% (57.78M → 47.30M). The 24.05M on TUgSg… is stake delegated to other addresses (the TRX still belongs to it; only energy/bandwidth is delegated out, and the hot wallet TWhDf… gets its resources from it). Counting it, that address matches the snapshot exactly.
• The real decrease is TSzSg…: 20.39M → 10.16M, of which 11.45M went to the hot wallet TWhDf…; the hot wallet has sent 8,000+ transactions since 08-19 (7,162 USDT contract calls, 838 TRX transfers) and is the user withdrawal channel.
• The sTRX on TUgSg… fell from 50.0M to 39.2M while that address has sent no transaction since 08-01 ⇒ the 10.8M sTRX was moved by an already-approved contract; destination not traced.
• Whether the liability side fell in step over the month has to wait for Poloniex's 09-01 snapshot (as of 09-04 GitHub still shows the 08-01 version).

7.2 BTC-TRC20 (BTCTRON): contract, holders and collateral

BTCTRON is the "BTC" Poloniex issued on Tron in 2020; HTX's PoR books it as BTC-TRC20 inside its BTC reserves. Contract TN3W4H6rK2ce4vX9YnFQHwKENnHjoxb3m9 (tronscan). Everything in the table is an on-chain read.

The above records what we could not find on Poloniex\'s published addresses and PoR page: no asset marked as BTCTRON reserve. Collateral may exist in undisclosed addresses; on-chain search cannot rule that out.

8. Realisability of affiliated tokens: reserve holdings ÷ 30-day average daily volume (measured 2026-09-14; red = affiliated share >30% or staked share >50%, the §2/§10 rules)

In §2 every exchange's "affiliated token" enters reserves at market price. This section asks the same question of each: if it had to be sold, how much can the market absorb per day? Uniform reading: the reserve holding of the token divided by the average daily volume over the last 30 complete days (single-day volume swings widely; the 30-day average is steadier), giving the days needed to sell it all at that pace. Volume is given on two bases: major venues = the spot pair's daily klines summed across whichever of Binance, OKX, Bybit, KuCoin, Gate, Bitget, Kraken, HTX, MEXC and Bitfinex list the pair (primary; venue count in the table); market-wide = the token's volume across all listed venues as recorded by CoinGecko (⚠ third party, venues not individually checked). Days are computed on the major-venue basis; the market-wide figure is reference only, because its bulk usually comes from venues outside the major ten (see reading). ±2% depth (dollar amount fillable at once) is listed for reference. Script tools/affiliated_liquidity.py, readings in data/affiliated_liquidity_2026-09-14.json; holdings follow the §2 reads of 09-14 (reserves × affiliated share); HTX's TRX is this report's direct on-chain read, the HTX token carries last week's figure marked ⚠.

How to read

• Days-to-sell is misleading on its own and must be read with the share: Binance's BNB would take about 177 days, and BNB is only 16% of reserves with 72% in hard assets, which is not a problem; Bitfinex's LEO is 33% of reserves and would take about 26,700 days (about 73 years, the same on both bases), and only when both hold is realisability a problem. The "reserve value" of an affiliated token is price times quantity, not money that can be realised — true for every exchange.
• Why the market-wide basis is reference only: of CoinGecko's TRX volume, the ten major venues account for 16%; the largest contributors are FameEX (12%), WhiteBIT (7%) and Phemex (6.5%), with Binance at only 7%. Of BNB's market-wide volume, major venues account for 27%, Binance 19%, the rest from P2B, CoinUp, BTCC, XT and similar. In both cases the bulk of the market-wide figure sits on venues this report does not check individually. TRX takes about 45 days at the major-venue 30-day average (about 8 on the market-wide basis); HTX's realisability issue is not TRX volume but its share of reserves (47% + 5.7%) and the 69% staked. Bitfinex's LEO is 32% with the other 61% in BTC; Binance's BNB is 16% with the other 72% in BTC, ETH and stablecoins.
• To judge an exchange's ability to pay under stress, mark affiliated tokens to tradable volume rather than market price, then look at hard-asset (BTC / ETH / stablecoin) coverage of liabilities. On that basis (§5 table): Binance and OKX remain ≥100%; HTX's hard-asset coverage is under half.

9. Reproduce

pip install curl_cffi
python3 tools/cex_reserves_verify.py --chain all                                    # all three chains
python3 tools/cex_reserves_verify.py --chain eth --ex okx --retry-failed data/cex_reserves_2026-09-21.json
python3 tools/cex_reserves_verify.py --refresh-addresses                            # re-pull official address lists
python3 tools/beacon_validators.py 0x3262f13a39efaca789ae58390441c9ed76bc658a 0xf666814c2ae92ca0e06667f80dac1eb8a97e48ae 0x5c95a672e34b3252482ed9a215f2926d2887845d 0x88a4df73aac310484c60c4c0ac4904cab938c20b   # count Beacon-chain validators by withdrawal address (§3.2 Bitstamp)
python3 tools/por_fetch.py                                                          # official PoR self-reported figures (§3.1 last column; Binance needs a manually saved page, data/por_manual.json)

Known pitfalls (handled in the scripts): public nodes silently truncate batched eth_call; Tron eth_getBalance excludes staked TRX, use getaccount; trongrid's free tier is 3 rps and silently degrades if pushed; Blockscout has no price for platform tokens, so KCS/GT/BGB are read directly on chain.

10. Monitoring indicators (one set, read per exchange)

The six indicators below are read the same way for every exchange, with the same trigger rules; readings are from the 2026-09-03 snapshot. "—" = not applicable to that exchange (no custody column, no native staking token, no affiliated asset).

Source grades

• Primary: direct on-chain reads; official PoR pages and GitHub lists; the FCDO sanctions list; each venue's public market API.
• Third party: DefiLlama, CoinGecko.
• Media ⚠: Protos, TRM Labs and similar reporting, used only as leads.

Disclaimer

This page is a compilation and cross-check of public data. It is not investment advice and makes no claim about any institution's solvency. All liability-side figures are self-reported by the exchanges and cannot be verified by this report. Every statement here is limited to publicly verifiable data; not finding an asset on the published addresses does not mean the asset does not exist.