The Sun Exchange Empire: Poloniex, HTX, and the Concentration of Custodial Control

Most TRON walletsSoftware or hardware that stores private keys and uses them to sign transactions. A wallet holds keys, not coins — balances live on the ledger itself — so the same funds can be reached from any wallet loaded with the same keys, and losing the wallet loses nothing if the keys are backed up elsewhere. are born from an exchange hot walletAn online, always-connected wallet a service uses for day-to-day operations — paying withdrawals, sweeping deposits, funding fresh addresses. Because its keys live on internet-connected systems, a service keeps only working balances in it; in tracing work, a service's hot wallet often shows up as the first funder of the addresses it operates., so the question of who stands behind the major exchanges is not gossip — it is upstream of nearly every origin trace. Between 2019 and 2023, one person came to publicly speak for two of the venues whose hot wallets appear constantly in TRON histories: Poloniex and Huobi (now HTX). That person also founded and led the chain itself.

The record of how that happened is uneven. Parts of it sit in clean corporate announcements; parts exist only in Sun’s own social-media posts; and one widely repeated claim — that the SEC alleged Sun’s control of Poloniex — is not in the pleadings at all. This article lays out what each document actually says.

The payoff for an investigator is a sharper read on the custodyAn arrangement in which one party — the custodian — holds the private keys or reserves controlling assets that belong to others. On a blockchain, whoever holds the keys is the on-chain owner: custodied funds sit under the custodian's addresses, so the entity an analyst sees acting on-chain is the custodian, not the customer. boundary. An exchange deposit normally ends an attributionThe process of identifying the entity most likely to control a blockchain address by combining on-chain signals — who created and funded it, how it transacts, which keys can act for it — with known service patterns and labels. Attribution conclusions are evidence-weighted judgments, not certainties, and are strongest when several independent signals converge. chain at an institution with its own keys, its own compliance function, and its own incentives. Where one principal spans venues and the underlying network, that assumption deserves a second look before it goes in a report.

Poloniex: from Circle to “an Asian investment group”

The paper trail on Poloniex’s ownership goes dark in October 2019, and it has stayed dark. Circle acquired Poloniex on February 26, 2018, announcing it had “officially acquired Poloniex, a leading tokenA unit of value recorded inside a smart contract rather than in the chain's native ledger — the contract keeps the balance table, and moving tokens means asking the contract to update it. Not to be confused with a coin, which is the chain's built-in asset (TRX on TRON) used to pay for the network itself. exchange platform” without disclosing terms; contemporaneous press put the price near $400 million, a figure Circle never confirmed.

Twenty months later, on October 18, 2019, Circle announced Poloniex would “spin out” into a new company, Polo Digital Assets, Ltd., “backed by an Asian investment group.” Poloniex’s own announcement described “backing of a major investment group” and “a multiyear plan to spend more than $100M to develop and expand Poloniex.” US customers lost trading access on November 1, 2019, with withdrawals through Circle guaranteed “until at least December 15, 2019.” Neither company named a single member of the consortium.

Sun’s position moved fast. When reporting first tied him to the deal, he denied it in a post — “I’m not buying anything.” On November 12, 2019, during a joint Tron–Poloniex event livestreamed on Twitter, he confirmed he was among the investors: “Poloniex is one of the biggest exchanges in our industry. I think the exchange is going to grow and that’s why we collaborate with it to have more initiatives.” He added that the exchange operated independently of TRON.

The record that exists. Circle’s spin-out announcement, Sun’s on-camera confirmation, and — four years later — Sun personally announcing Poloniex’s hack response, bounty terms, and loss-coverage assurances from his own account. No filing, prospectus, or registry entry naming the consortium’s members has surfaced.

The record that doesn’t. “Justin Sun owns Poloniex” is the standard press shorthand, and his 2023 conduct supports the substance of it. But if a report needs a citable ownership fact, the strongest available primary is Sun’s own November 2019 confirmation of an investment stake. Write it that way.

What the SEC pleadings say — and what they don’t

The SEC’s case against Sun is the most-cited document in his file, and it is routinely cited for things it does not contain. The Commission sued Sun, the Tron Foundation, the BitTorrent Foundation, and Rainberry on March 22, 2023 in the Southern District of New York (1:23-cv-02433), alleging unregistered offers and sales of TRXThe native coin of the TRON network. TRX settles value directly (no contract call needed), is staked to obtain Energy, Bandwidth, and voting power, and is burned to pay fees when staked resources fall short. Its smallest unit is the sun: 1 TRX = 1,000,000 sun. and BTT, manipulative wash trading, and undisclosed paid promotion.

On the trading-venue question, the pleadings are specific. The original complaint anonymized the wash-trading venue as “the Trading Platform”; the amended complaint of April 18, 2024 names it: Sun’s team “conducted the wash trading of TRX on at least Bittrex,” a Seattle-based platform, through nominee accounts opened in employees’ names. The original complaint also quotes an internal directive to “concentrate on binance, bittrex, bithumb, upbit exhanges [sic]” for volume targets.

Poloniex appears nowhere in either pleading. Neither does Huobi. A grep of both documents returns zero hits. The complaint alleges Sun’s control over trading accounts used for manipulation — it alleges nothing about his control over any exchange. Investigators citing the case for a Sun–Poloniex control claim are citing a document that never makes it. The case itself ran to a March 2026 final judgment — claims against Sun dismissed with prejudice, one $10M consent penalty against Rainberry — covered in Justin Sun, the SEC, and the long road to a $10M settlement.

Huobi becomes HTX

Huobi’s change of control, by contrast, has a clean corporate announcement — with a hole where the beneficial owner should be. On October 7, 2022, Huobi Global announced that its controlling shareholder — founder Leon Li — had sold “its entire shareholding” to a buyout vehicle managed by About Capital Management (HK) Co., Limited. The release promised “a global strategic advisory board led by leading industry figures” and “the injection of sufficient capital in margin and risk provision fund.” Deal value was not disclosed; press reports put the stake near $1 billion.

Days later, Huobi announced Sun as the first member of that advisory board, tasked with guiding “business market, brand, compliance, risk control, and other fields.” Asked directly whether he was the buyer, Sun told CoinDesk on October 11, 2022: “In the future we might have a chance to purchase Huobi, but not this time.” Contemporaneous media reporting identified Sun as the real party behind About Capital’s vehicle; that identification is reporting, and the corporate record neither confirms nor refutes it.

The branding closed the distance the disclosures kept open. On September 13, 2023, Huobi rebranded as HTX, and the exchange’s own announcement decoded the name: “H” for Huobi, “T” for “TRON with a commitment to being all in TRON,” “X” for the exchange. Whatever the shareholder register says, the venue publicly fused its identity with Sun’s chain. From that point, the “advisor” title and the exchange’s self-description pointed in different directions.

Late 2023: three breaches in nine weeks

The security record is where the ownership question stopped being abstract. Between September 24 and November 22, 2023, three separate incidents hit Sun-linked infrastructure, and in each one the figure announcing losses, bounties, and reimbursements was Sun.

Date	Target	Loss	Figure source
Sep 24–25, 2023	HTX hot wallet	~$8M in ETH (5,000 ETH per Sun)	Sun’s own Sept 25, 2023 X disclosure; CoinDesk’s writeup says 500 ETH, inconsistent with its own ~$8M figure
Nov 10, 2023	Poloniex hot wallets (ETH, TRON, BTC)	~$120M–$130M	PeckShield breakdown ($56M ETH, $48M TRX, $18M BTC); SlowMist tally ~$130M
Nov 22, 2023	Heco Chain bridgeA protocol that moves value between blockchains, most commonly by locking the asset in a contract on the source chain and minting a wrapped equivalent on the destination chain (lock-mint), redeemed later by burning the wrapped token to release the original (burn-release). For tracing, a bridge's contract addresses are shared plumbing: a flow into a bridge marks a chain boundary to carry the investigation across, and the bridge itself is never the origin of the funds. A bridged, wrapped stand-in is also not the same asset as a native issuance on the destination chain — see native vs bridged. + HTX hot wallets	$86.6M bridge + ~$12.5M HTX	rekt.news / PeckShield

The September incident set the template. Sun disclosed a loss of about $8 million in ETH on X — 5,000 ETH per his own disclosure (CoinDesk’s writeup says 500 ETH, inconsistent with its own ~$8M figure) — then framed it against “the $3 billion worth of assets held by our users,” said HTX had covered the losses, and offered the attacker a white-hat deal.

Poloniex was an order of magnitude larger. Security firm Cyvers flagged abnormal outflows at 10:55 UTC on November 10, 2023; PeckShield and SlowMist tracked drains across Ethereum, TRON, and Bitcoin hot wallets. Sun posted that “the losses are within manageable limits, and Poloniex’s operating revenue can cover these losses,” then offered “a five percent white hat bounty to the Poloniex hacker” with “7 days to consider this offer before we engage law enforcement.” He also posted that “the Poloniex team has successfully identified and frozen a portion of the assets associated with the hacker’s addresses.” All of these statements are posts from Sun’s personal X account, and for several of them no other official record exists.

Twelve days later the Heco bridge — the Ethereum bridge of the Huobi-originated Heco Chain — was drained of $86.6M through a compromised operator account, while HTX hot wallets were hit in parallel. The HTX statement, again relayed by Sun: “HTX and Heco Cross-Chain Bridge Undergo Hacker Attack. HTX Will Fully Compensate for HTX’s hot wallet Losses. All Funds in HTX Are Secure.” On-chain trackers put the HTX hot-wallet side of the incident near $12.5M.

Two features of this ledger matter forensically. Reimbursement promises came from a personal account whose holder’s formal title at both venues was advisor or investor — the operational voice and the disclosed role never matched. And the Poloniex freeze announcement is direct evidence of venue-level fund control being exercised mid-incident: whoever “the Poloniex team” answered to could freeze assets on command.

What concentration does to the custody boundary

For an origin-tracer, an exchange hot wallet is the single most common first activator a fresh TRON wallet ever touches — the history of how that came to be is in how exchanges adopted TRON, which covers a different phenomenon than this article: third-party exchanges adding TRON support, versus the ownership of the venues themselves. In TRONORIGIN’s own analysis, roughly two in five TRON wallets are first funded from a custodial system — the project’s empirical observation rather than an externally published statistic — so the tracer’s working model is load-bearing: funds that enter an exchange pass behind an institutional boundary, where the exchange’s keys, ledger, and compliance function take over.

That model rests on an assumption of independence. The exchange is presumed to be a separate party from the chain, from the counterparties, and from any principal under investigation. Attribution stops at the institution because the institution is its own actor — the mechanics of reading that boundary are the subject of exchange deposit addresses.

Concentration weakens the assumption at both ends. On TRON, a wallet’s first funderThe address that made the first meaningful inbound value transfer to a wallet, establishing its earliest economic relationship. It is a strong origin signal — someone chose to be the first to put value into the wallet, usually close in time to its creation. On TRON the signal is amplified: a new address must be activated by an existing account (typically via its first TRX or TRC-10 transfer), so the first funder is often also the account's on-chain creator. is very often an HTX or Poloniex hot wallet; the chain those wallets operate on is led by the same principal who speaks operationally for both venues. “Who controls the funds” then has answers at more than one layer — the customer holds a claim, the venue holds the keys, and one person’s influence spans the venue and the network the venue’s wallets sit on. The 2023 freeze announcement shows what that means in practice: assets inside the venue moved to frozen status on the say-so of the same voice that speaks for the chain.

The practical adjustments are modest and concrete. When a trace terminates at an HTX or Poloniex hot wallet, record the custodial boundary as usual — then note in the report that the venue is Sun-linked, with the specific citations above rather than the press shorthand. When funds hop between Sun-linked venues, or between a venue and TRON-native services, do not treat each hop as crossing into a fully independent institution; the hops may share a principal even where they cross corporate lines. And when a subpoena or exchange-records request is on the table, the entity question — Polo Digital Assets, HTX’s operating company, the governing jurisdiction — is harder than usual precisely because the ownership record is thin. The tracing techniques themselves don’t change; following the money works the same way on either side of the boundary.

The history here is a case study in the difference between what is asserted, what is documented, and what is demonstrated. Ownership of these venues was asserted by the press, half-documented by corporate announcements that stop short of naming names, and demonstrated — more convincingly than any filing — by who showed up to announce the losses when the hot wallets were drained. As of July 2026, no fuller ownership record for either venue has entered the public domain. An investigator should hold all three tiers in view, cite the tier the evidence actually comes from, and treat the custody boundary at a Sun-linked venue as a real boundary with an asterisk: the institution behind it is not as independent of the chain as the standard model assumes.

Sources

Primary records and contemporaneous documentation used for facts in this article:

• Circle. “Circle Acquires Poloniex” (February 26, 2018) — Circle’s own acquisition announcement; confirms the acquisition and the absence of disclosed terms. The ~$400M price comes from contemporaneous press reports; Circle disclosed no terms.
• Circle Investor Relations. “Poloniex to Spin Out of Circle” (October 18, 2019) — the spin-out to Polo Digital Assets, Ltd., the “backed by an Asian investment group” wording, and the US customer cutoff dates. Primary corporate record.
• Poloniex. “Poloniex Spins Out from Circle with New Backing & Global Focus” (October 18, 2019) — the exchange’s own account: “$100M” multiyear plan and US trading/withdrawal timeline. Primary actor record.
• CoinDesk. “Despite Denials, Tron Founder Confirms Investment in Poloniex Crypto Exchange” (November 12, 2019) — contemporaneous record of Sun’s confirmation during the Tron–Poloniex Twitter livestream, and of his prior denial, quoted below. The livestream itself is the primary; this is the surviving contemporaneous account of it. coindesk.com answers an automated fetch with an HTTP 429 bot wall, so the archived revision below is what the audit reads.
• CoinDesk. “Despite Denials, Tron Founder Confirms Investment in Poloniex Crypto Exchange”, archived 2021-09-18 — the capture read in place of the live page, carrying “Poloniex was acquired by Circle in early 2018 for $400 million” and the denial itself, “I’m not buying anything”.
• SEC v. Sun et al., No. 1:23-cv-02433 (S.D.N.Y.). Complaint (March 22, 2023) — wash-trading allegations, “Trading Platform” anonymization, the “concentrate on binance, bittrex, bithumb, upbit exhanges [sic]” directive. Verified directly: contains no mention of Poloniex or Huobi.
• SEC v. Sun et al. Amended Complaint, Doc. 59 (filed April 18, 2024; via CourtListener/RECAP) — names Bittrex as the wash-trading venue (“wash trading of TRX on at least Bittrex”). Verified directly: also contains no mention of Poloniex or Huobi. Primary court record.
• SEC Press Release 2023-59. “SEC Charges Crypto Entrepreneur Justin Sun and His Companies for Fraud and Other Securities Law Violations” (March 22, 2023) — the Commission’s own framing of the charges.
• Huobi Global (via PR Newswire). “Huobi Global’s Major Shareholder Completes Share Sale” (October 7, 2022) — sale of the entire controlling shareholding to the About Capital buyout vehicle; advisory board and capital-injection language; Leon Li quote. Primary corporate record. The ~$1B stake value comes from press reports; the release gives no deal value.
• HTX community post. “Justin Sun joins Huobi Global” (October 2022) — the exchange’s own record of Sun’s appointment to the Global Advisory Board and its remit; the appointment was also distributed as an October 10, 2022 press release (“H.E. Justin Sun to Serve as First Huobi Global Advisory Board Member”).
• CoinDesk. “Justin Sun ‘Optimistic’ About Crypto’s Return to China, Addresses Huobi Acquisition” (October 11, 2022) — Sun’s on-record denial of being the Huobi buyer: “In the future we might have a chance to purchase Huobi, but not this time.”
• HTX. “Huobi Rebrands to HTX, Unveils Global Expansion Roadmap” (September 13, 2023) — the exchange’s own rebrand announcement, including “T represents TRON with a commitment to being all in TRON.” Primary actor record.
• CoinDesk. “Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says” (September 25, 2023) — the September 2023 HTX breach; loss figure and coverage commitment per Sun’s X posts (personal posts, the sole public record of both). coindesk.com answers an automated fetch with an HTTP 429 bot wall, so the archived revision below is what the audit reads.
• CoinDesk. “Crypto Exchange HTX Lost $8M of Ether Due to a Hack, Justin Sun Says”, archived 2023-09-26 — a capture from the day after publication, read in place of the live page, carrying Sun’s “$8 million represents a relatively small sum in comparison to the $3 billion worth of assets held by our users.” The report’s own text says “500 ether,” which is inconsistent with the ~$8M dollar figure it also carries; the 5,000 ETH count in this article follows Sun’s disclosure.
• The Register. “Justin Sun offers 5% deal to $120M Poloniex crypto-robbers” (November 10, 2023) — contemporaneous record quoting Sun’s X posts (the “losses are within manageable limits, and Poloniex’s operating revenue can cover these losses” statement, the 5% white-hat bounty with its 7-day window, and the freeze announcement) and security-firm tallies: PeckShield’s per-chain breakdown and SlowMist’s ~$130M total. Sun’s underlying posts are user posts on his personal account; for several statements they are the sole public record.
• rekt.news. “HECO Bridge, HTX” (November 22, 2023) — pseudonymous security-research post-mortem (a non-primary breach record) of the Heco bridge exploit: $86.6M bridge loss, $12.5M HTX hot-wallet figure, compromised-operator-account cause, attacker addresses, and the HTX/Sun compensation statement. It is the sole cite here for the $86.6M figure.