The Steem Takeover: How Custodied User Stake Captured a Blockchain

A Delegated-Proof-of-Stake chain hands block production to a small set of validators elected by tokenA unit of value recorded inside a smart contract rather than in the chain's native ledger — the contract keeps the balance table, and moving tokens means asking the contract to update it. Not to be confused with a coin, which is the chain's built-in asset (TRX on TRON) used to pay for the network itself. vote. The security assumption underneath it is that vote weight tracks genuine stakeholders — people who hold the token because they have a stake in the network’s future. The Steem takeover is the case that tested what happens when a large block of vote weight is neither held by genuine stakeholders nor controlled by the people who deposited it.

For an investigator, the useful part is the on-chain pattern the episode exposes: validator-election votes cast from exchange custodyAn arrangement in which one party — the custodian — holds the private keys or reserves controlling assets that belong to others. On a blockchain, whoever holds the keys is the on-chain owner: custodied funds sit under the custodian's addresses, so the entity an analyst sees acting on-chain is the custodian, not the customer. addresses, moving stake their customers deposited. That pattern is visible, it is legal, and on TRON it happens every six hours. Steem is the worked example of it going hostile.

What Sun actually bought

On February 14, 2020, Steemit Inc. announced it was joining the TRON ecosystem. The announcement used partnership language, but the substance was an acquisition: Sun bought Steemit Inc. — the company — and with it the company’s holdings.

The distinction is the whole story. Steem, the blockchainA shared ledger maintained by many independent computers, in which transactions are grouped into blocks and each block cryptographically references the one before it. Because rewriting any past entry would break every link after it, the record is effectively append-only — new entries can be added, but history cannot be quietly altered., was decentralized and ran on its own elected witnesses. Steemit, the company, held an enormous founder stake that traced back to the chain’s 2016 launch. Buying the company transferred the stake, and only the stake.

That stake was contentious before Sun ever appeared. At Steem’s March 2016 launch the founders mined roughly 80% of the initial supply in the network’s first days — a “ninja-mine” the community never fully accepted as legitimate. By 2020 the controlled portion had diminished but remained enormous: Sun himself put it at around 65 million STEEM, on the order of 20–30% of the supply, though other accounts cite somewhat higher figures. (The acquisition price was reported at just under $8 million; the official announcement named no number.)

No code held that stake in check. Former witnesses later told reporters that Steemit had always committed not to vote those coins in witness elections — to treat the stake as ecosystem capital, not governance power. The commitment was a norm, and norms transfer poorly in an acquisition.

The soft fork: code over promises

The witnesses did not wait to find out whether the new owner would honor the norm. On February 23, 2020, a majority of Steem’s consensus witnesses activated soft fork 0.22.2, which restricted the Steemit-controlled accounts from moving or voting their stake.

One of the witnesses behind it, posting under the handle therealwolf, summarized the reasoning in one line: “words can easily be broken, code can not.” The witnesses framed the fork as temporary and reversible, affecting no accounts other than the ones holding the disputed stake.

The soft fork turned a quiet ownership change into a governance war. The witnesses had used their control of the validator set to neutralize the founder stake. To undo it, that holder needed to control the validator set — which, on a DPoSA consensus design in which coin holders do not validate blocks themselves but vote — with weight proportional to their stake — to elect a small, fixed set of block producers. TRON runs a DPoS system in which the 27 top-voted candidates become the Super Representatives that produce blocks, re-elected at regular intervals, which trades some validator decentralization for fast, cheap blocks. chain, means controlling the vote.

The exchange vote

The founder stake alone could not outvote a coordinated witness set that had just forked against it. More vote weight had to come from somewhere. It came from exchanges.

On March 2, 2020, accounts operated by Binance, Huobi, and Poloniex cast votes using customer-deposited STEEM, replacing the sitting witnesses with a new slate. Reporting at the time traced the voting power to a single recipient account, @dev365, said to be Sun-aligned. The freeze was reversed; the witness set changed hands.

Each exchange came at it differently, and the differences matter for reading what happened.

Exchange	What it did	How it explained it
Binance	Voted ~31.73 million customer STEEM, then reversed within about a day	CZ called it an “oversight” and a rubber-stamped upgrade; Binance later apologized and stated it “stays neutral and has no interest in on-chain governance”
Huobi	Voted customer STEEM, then withdrew its votes	Said it had been told the network was “at immediate risk of an attack” and acted to protect user assets
Poloniex	Voted customer STEEM	Sun-affiliated: Sun had confirmed in November 2019 that he was among a group of investors who spun Poloniex out of Circle, while maintaining the exchange “operated independently”

The Binance reversal is the best-documented part of the episode, because Binance documented it. CZ posted “Done, unvoted” the day after the vote, and Binance followed with a public letter to the Steem community apologizing for acting on “miscommunication about the specifics of the blockchain’s upgrade.” Here is an exchange publicly accounting for a vote of 31 million units of customer stake, and naming neutrality as the correct posture. The voting power had been sitting in custody the whole time; deploying it was a policy decision, and the community argued the exchange back out of it within about a day.

Sun, for his part, denied a hostile takeover, calling the characterization false and stating that all parties’ votes would be withdrawn.

The fork that left the stake behind

The witnesses could not win a vote-weight contest against exchange custody, and they did not try to. On March 20, 2020, at 14:00 UTC, the community launched Hive — a hard fork of the Steem codebase running as an independent chain. Hive airdropped HIVE to STEEM holders at 1:1, mirroring liquid balances, staked positions, and the chain’s dollar-pegged token. With one exception.

The Hive launch announcement stated it plainly: the only accounts excluded from the initial airdrop were “those containing the Steemit Inc ninja-mined stake, and those who actively contributed to (and publicly declared support for) the centralization of the Steem Blockchain.” The excluded accounts still existed on Hive — they could participate — but they received nothing in the snapshot.

That exclusion is the structural counter to a custodial-stake capture, and it only works because of how forks distribute value. A fork’s airdrop is a fresh allocation, decided by whoever writes the genesis snapshot, and the Hive founders used that one-time discretion to disenfranchise the captured stake and its enablers on the new chain while preserving every ordinary holder’s balance. The captured stake kept the old chain; the community kept the value and walked to a new one.

What it looks like on-chain

Strip away the actors and the episode is a sequence of ordinary transactionA signed instruction ("tx" for short) that changes on-chain state — transferring value, calling a contract, or updating an account's settings. Once it is included in a block and that block reaches finality the record is permanent: later transactions can supersede its effects, but the entry itself can never be edited or deleted. Before finality, a freshly included transaction can still be reversed if its block is reorganized out. types used adversarially.

Witness-vote transactions from custody addresses. The takeover vote used no exploit. Standard witness-voting operations, signed by exchange-controlled accounts, carrying vote weight derived from customer deposits. An investigator reading the Steem chain around March 2–3, 2020 sees governance votes originating from addresses that are, in every other respect, exchange hot walletsAn online, always-connected wallet a service uses for day-to-day operations — paying withdrawals, sweeping deposits, funding fresh addresses. Because its keys live on internet-connected systems, a service keeps only working balances in it; in tracing work, a service's hot wallet often shows up as the first funder of the addresses it operates..

The provenanceThe documented origin and path of an asset — where value first appeared and every change of hands since. The word is borrowed from the art world, where an object's provenance is the ownership chain that authenticates it. On a public blockchain, provenance is unusually strong because every transfer is permanently recorded, so an asset's path across addresses can be reconstructed from the ledger itself — up to the points where the trail leaves it, such as a custodian's internal books or a cross-chain crossing. gap. The stake those votes carried belonged to depositors — people who had handed custody to an exchange for safekeeping and never authorized a governance position with it. On-chain, the vote looks entirely legitimate — correct signaturesA cryptographic proof, produced with a private key over a transaction's exact contents, that the key holder authorized that transaction and no other. Nodes verify the signature before accepting the transaction, so a valid signature is definitive evidence the key was used — though not of who was holding it at the time., valid stake. The illegitimacy is in the provenance, which the chain does not record. AddressA public identifier, derived from a key pair, at which an account receives funds and is looked up on-chain. Anyone can view an address's history, but only the matching private key can spend from it. TRON addresses are 34-character Base58Check strings beginning with "T". activation teaches the same lesson in reverse: an exchange appearing as the first activator of a walletSoftware or hardware that stores private keys and uses them to sign transactions. A wallet holds keys, not coins — balances live on the ledger itself — so the same funds can be reached from any wallet loaded with the same keys, and losing the wallet loses nothing if the keys are backed up elsewhere. tells you funds moved through custody without telling you who controls them. Here, an exchange appearing as a voter tells you custody was mobilized, not that the exchange had a genuine stake.

And the fork snapshot itself is a governance act. The Hive airdrop’s exclusion list is a deliberate, auditable on-chain decision: specific accounts zeroed in a genesis snapshot. Reading a post-fork chain means knowing that balances are not always continuous across a fork — some were severed on purpose, and the severance records who the fork’s authors judged to have acted in bad faith.

Why a TRON investigator should care

TRON runs the same family of consensus. Its 27 Super Representatives are elected by TRON PowerTRON's voting weight: staking TRX grants TRON Power at one unit per TRX staked, spendable as votes for Super Representative candidates. It is non-transferable — it cannot be sent or sold, only earned by staking — and unstaking revokes it along with the votes it was backing. TRON Power is how holdings translate into governance influence under delegated proof-of-stake: block-producer elections are decided by staked, revocable votes rather than by one account, one vote. vote, and the largest concentrations of TRON Power have sat where the largest concentrations of STEEM sat in 2020: in exchange custody. As the Super RepresentativesOne of the 27 elected block producers on the TRON network, chosen every six hours from a wider candidate pool by TRON Power voting (one vote per staked TRX); candidates ranked 28th–127th, called SR partners, earn voting rewards without producing blocks. SRs collect block and vote rewards and pass a share to their voters after deducting a self-set commission. TRON's protocol code also calls these producers "witnesses" — a term other DPoS chains such as Steem and Hive use for the same role. article documents, major exchanges — Binance, HTX (formerly Huobi), OKX, and Poloniex among them — have held or influenced SR seats by voting custodied TRXThe native coin of the TRON network. TRX settles value directly (no contract call needed), is staked to obtain Energy, Bandwidth, and voting power, and is burned to pay fees when staked resources fall short. Its smallest unit is the sun: 1 TRX = 1,000,000 sun., the identical mechanic that decided the Steem takeover, operating continuously and within the rules.

What separates the two chains is posture. On TRON, exchanges self-voting custodied stake is the steady state of the validator set, and the network treats it as normal infrastructure. Steem demonstrates what the same capability does once it gets pointed at a specific governance outcome and the holders of the stake decide to use it.

For attributionThe process of identifying the entity most likely to control a blockchain address by combining on-chain signals — who created and funded it, how it transacts, which keys can act for it — with known service patterns and labels. Attribution conclusions are evidence-weighted judgments, not certainties, and are strongest when several independent signals converge. work, the takeaway is concrete. An exchange address casting validator-election votes is moving value it holds in custody for depositors, and its appearance in a governance position is silent on genuine stake and intent; all it establishes is that custody was available and someone chose to deploy it. Sun’s broader pattern of acquiring infrastructure and influence across the ecosystem is the subject of his regulatory history; the Steem episode is the moment that pattern collided with a community willing to abandon its own chain rather than be governed by captured stake.

Sources

Primary records and contemporaneous documentation used for facts in this article:

• Hive. “Announcing the Launch of the Hive Blockchain” — The Hive founders’ own launch announcement: March 20, 2020 / 14:00 UTC date, the 1:1 STEEM→HIVE airdrop mechanics, and the verbatim exclusion of the Steemit ninja-mined stake and accounts supporting centralization. Primary actor record.
• Binance. “A Letter to the STEEM Community” (March 10, 2020) — Binance’s official account: the ~31.73 million STEEM voted, the apology, and the “stays neutral and has no interest in on-chain governance” position. Primary actor record.
• CZ (Changpeng Zhao). “Done, unvoted…” (Twitter, March 3, 2020) — Binance’s same-day reversal and the “oversight / rubber stamp” characterization. User-generated (social) post by the principal actor; corroborated by the Binance blog letter above.
• therealwolf. “Steem Protective Soft Fork v0.22.2” — A consensus witness’s own statement: the February 23, 2020 / 10PM UTC activation, the temporary-and-reversible framing, and the “words can easily be broken, code can not” rationale. Primary actor record.
• CoinDesk. “Despite Denials, Tron Founder Confirms Investment in Poloniex Crypto Exchange” (November 12, 2019) — Sun’s own confirmation that he was among the investor group that spun Poloniex out of Circle, with the “operated independently” caveat. Reports the principal’s direct statement.
• CoinDesk. “Steem Community Mobilizes ‘Popular Vote’ in Battle With Justin Sun” (March 3, 2020) — The witnesses’ account of the non-voting commitment (“Steemit had always committed not to vote those coins”), the Binance and Huobi vote reversals, and Sun’s statement that a “hostile takeover” characterization was false and all parties’ votes would be withdrawn. Contemporaneous reporting quoting the actors directly.
• Decrypt. “Did Binance Just Help Justin Sun Take Over the Steem Network?” (March 2, 2020) — The three-exchange involvement: names Binance, Huobi, and Poloniex as the accounts voting customer STEEM, and traces the delegated voting power to @dev365, the account alleged to be Sun’s. Contemporaneous reporting of the vote itself.
• Huobi. “Community Counts: A Letter To The Steem Community” (Medium, March 3, 2020) — Huobi’s own statement: the verbatim “immediate risk of an attack” line and the withdrawal of its votes. Primary actor record.

A note on sourcing: this episode played out largely on the Steem and Hive blockchains and on social media, so several primary records are the actors’ own chain posts and tweets, flagged above as such. Figures the principals dispute — the size of the founder stake and the reported acquisition price — are presented in the text as reported rather than settled, with the disagreement noted.