Hi,
I saw your post talking about the OKEx,
I got involved in a scam related to this private address: 0x5041ed759Dd4aFc3a72b8192C143F72f4724081A
I found you have deep knowledge about this case.
I very much appreciate any of your thoughts about this.
Send me a message to this email address: [email protected]
nart
Topic: OKEx CEO LIES? Personal investigation on OKEx wallets condition (Read 141 times)
October 30, 2020, 02:50:44 PM
On October 16, OKEx announced they'd been out of touch with one of their private key holders and thus decided to suspend any withdrawals.
Amidst the panic and lack of information there have been some rumors that OKEx wallets had been devastated by either the hackers, the Chinese police or the exchange employees, and OKEx had lost control over the private keys, so billions of dollars worth of assets are permanently lost.
The exchange has taken refuge in silence, and THAT'S NOT OK. I decided to conduct my own OSINT investigation on the current exchange wallets condition.
First, I considered some data aggregated by the analyst companies.
According to Glassnode, as of October 19, OKEx has 202732 BTC. The information on another currencies is only available for paid accounts, which I don't have. If anybody has access to this information, check it out.
Screenshots:
https://twitter.com/glassnode/status/1317048711055331329
https://twitter.com/JayHao8/status/1318446481183973376
According to CryptoQuant, as of October 23, OKEx has 100480 BTC, 235.7M USDT, 13.4USDK, 1.3M TUSD, 923.18K DAI. Unfortunately, they don't track any other currencies.
I couldn't find any information about what particular addresses those two companies are tracking. Looks like they don't disclose it.
Next, I checked some blockchain explorers:
1) According to Etherscan.io, as for October 26, OKEx keeps the following reserves:
https://etherscan.io/address/0xa7efae728d2936e78bda97dc267687568dd593f3 (~$64M in ETH):
https://etherscan.io/address/0x6cc5f688a315f3dc28a7781717a9a798a59fda7b (~$300M in ERC20 tokens, including 923.18K DAI).
Other stablecoins were transferred to a separate wallet, which is not marked as belonging to OKEx.
https://etherscan.io/address/0x5041ed759dd4afc3a72b8192c143f72f4724081a (235.7M USDT, 13.4M USDK, 7.4M USDC, 1.3M TUSD, 1.1M PAX).
Thus it could be concluded that OKEx is currently possesses $623M in total, which is consonant to CryptoQuant information. There's been no spending transactions from those addresses since October 16.
2) According to Chain.info, as for October 25, OKEx has 270123.89 BTC (https://chain.info/exchanges/OKEX). There are 54 cold, 14029 hot and 325196 deposit wallets marked as belonging to OKEx, though I don't know how accurate marking is.
Here are OKEx' wallets with the biggest amounts in them:
https://chain.info/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS (cold wallet, 74296 BTC; 2 spending transactions have been performed since October 19!!!)
https://chain.info/38UmuUqPCrFmQo4khkomQwZ4VbY2nZMJ67 (cold wallet, 44736 BTC)
https://chain.info/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx (deposit wallet, 14500 BTC)
https://chain.info/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh (deposit wallet, 11405 BTC)
Since October 16, there have been no spending transactions from other 4, 32 and 9 cold wallets with 5000, 3000 and 2000 BTC in them respectively.
https://chain.info/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2 (hot wallet, 1008 BTC; the funds are still being spent!!!)
https://chain.info/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG (deposit wallet, 1200 BTC)
https://chain.info/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28 (deposit wallet, 844 BTC; the funds are still being spent!!!)
https://chain.info/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS (deposit wallet, 798 BTC)
https://chain.info/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay (deposit wallet, 719 BTC)
https://chain.info/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm (cold wallet, 654 BTC; the funds are still being spent!!!)
https://chain.info/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5 (deposit wallet, 392 BTC; the funds are still being spent!!!)
https://chain.info/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC (deposit wallet, 239 BTC; the funds are still being spent!!!)
https://chain.info/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg (deposit wallet, 200 BTC; the funds are still being spent!!!)
I didn't check other wallets with less than 200 BTC in them.
The conclusion is, given Chain.info marked OKEx addresses accurately, the exchange wallets aren't empty, and OKEx didn't lose control over the private keys (at least the major part of them). However, something about Chain.info remains unclear: the sum of the amounts in the addresses mentioned above is 284991, which contradicts the amount of 270123 indicated on https://chain.info/exchanges/OKEX.
3) Then I checked the addresses on BitInfoCharts.com.
Marked as OKEx wallets:
https://bitinfocharts.com/ru/bitcoin/address/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2
https://bitinfocharts.com/ru/bitcoin/address/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28
https://bitinfocharts.com/ru/bitcoin/address/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5
https://bitinfocharts.com/ru/bitcoin/address/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg
https://bitinfocharts.com/ru/bitcoin/address/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC
https://bitinfocharts.com/ru/bitcoin/address/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm
Marked as Coinbase wallets, not OKEx:
https://bitinfocharts.com/ru/bitcoin/address/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS
https://bitinfocharts.com/ru/bitcoin/address/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx
https://bitinfocharts.com/ru/bitcoin/address/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh
https://bitinfocharts.com/ru/bitcoin/address/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG
https://bitinfocharts.com/ru/bitcoin/address/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS
https://bitinfocharts.com/ru/bitcoin/address/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay
The rest of the addresses marked as 'unknown'.
It's not clear which of the two explorers is right about the ambiguous addresses. You might want to inspect the transactions involving those addresses yourself. For example, I can see a lot of transactions between them and bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2, which is marked as OKEx address on both explorers. However, this circumstance itself doesn't mean anything.
Conclusion: the fact that 1 cold, 1 hot and 4 deposit wallets are marked as OKEx wallets on both explorers suggests they actually belong to OKEx. Hence spending transactions are still being performed from all 6 of them!
An OKEx hot wallet is somehow related to withdrawing BTC to other exchange platforms after October 16:
https://chain.info/2d3f09bacf881d431c6bf8106123ff55f7b177ea037d0ceb397f9ffeffad60c0 (4 BTC sent to Binance on October 23)
https://chain.info/fb1361b99308befb66ecf407b96a16ba3c8255dfb15bfc8e2a76715e5ebcb348 (63 BTC sent to Bitfinex on October 25)
https://chain.info/bf0172dc4225a2c110e0d4701aa3cdc729e2a76bb3fc2520069f8a2827047b14 (11 BTC sent to Bitfinex on October 25)
Those are just a few first transactions that I happened to stumble on.
Examples of withdrawing bofore October 16:
https://chain.info/2eec7f94617fdddb242440094d53c710baf1df18d140f2ec4b951c2d0a7002a4 (277 BTC нa Coinbase 11.08.20)
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f (4 BTC нa Binance 14.10.20)
Conclusion: OKEx have been withdrawing BTC from their hot wallet to other exchanges. However, the purpose of this is not clear. Are they doing cross-exchange arbitrage or is it something much worse than that?
In support of this arbitrage idea, the OKEx deposit wallets (marked so by Chain.info and BitInfoCharts) are being refilled from other exchanges:
https://chain.info/3ad5a813e7df5e3518afb37ff2f9e2b8fb15cab15f65cba1280f9d084aac1cd0 (sent 291 BTC from Huobi on October 23)
https://chain.info/fa15c5d314a5de82e01f995488759eb13c4309e6bba5fa621d6d3acf32cfa0f7 (sent 195 BTC from Binance on October 24)
So, they are possibly doing arbitrage (using their clients' funds?), while everybody is waiting for them to resume withdrawing.
There are also some suspicious addresses that might be related to OKEx:
https://chain.info/1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR
https://chain.info/bc1qeskrez68qp79kjvmx5zlw32s3y9l4dscsnevsf
Related to the same wallet, as both of them are often used as transaction inputs.
Furthermore, they are combined into a single wallet #66388910:
https://bitinfocharts.com/ru/bitcoin/wallet/66388910
The first of them is regularly refilled from an OKEx hot wallet.
The same thing with these two addresses:
https://chain.info/15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h
https://chain.info/bc1q9uxc283pfrfasy8d7ntq3mdqnyvf6hlf4lgclf
Both of them are used as transaction inputs, and are combined into a single wallet #55366140:
https://bitinfocharts.com/ru/bitcoin/wallet/55366140
The first of them is regularly refilled from the wallet #66388910 mentioned above.
And now, we're getting to the most fascinating part. All 4 addresses are marked as OKEx addresses by Whale Alert, and there have been spending transactions from them after October 16! Proofs:
https://twitter.com/whale_alert/status/1317110095290007557
https://twitter.com/whale_alert/status/1317111042883964930
https://twitter.com/whale_alert/status/1317496764010799110
These transactions are on Chain.info:
https://chain.info/46d4fd3ea52a7e54d677cb7523a357f19858887205736d4fc15c6ed9c088968a
https://chain.info/2d74f1674bcae42ab51cb93376877fdf2c75b292e9a2695242bfa29e0735c47b
https://chain.info/da139eca250a46e9fa2bfc706946706816e46838fd5858c1b4990060ba4165a9
Jay Hao, OKEx CEO, denied OKEx being related to the first two addresses:
https://twitter.com/JayHao8/status/1317132370567327744
However, he didn't comment on the last transaction.
Philip Gradwell, chief economist of Chainalysis, also denied that 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belongs to OKEx:
https://twitter.com/philip_gradwell/status/1317120228510359552?s=20
Address 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR was also involved in two big transactions on 14 and 15 of October 2020.
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f
https://chain.info/e83d0f7bab35d01cbf8e7741a6cf4ede499fe35099c017a4df9908197bd8f25f
Both times they sent 5000 BTC from a hot OKEx wallet to this address? which is ~$113 in total.
Those transactions was also spotted on Glassnode:
https://twitter.com/glassnode/status/1317082760700448768
It could therefore be concluded that Glassonde doesn't consider 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR to be an OKEx address. However, if the address has nothing to do with OKEx, why are they still transferring BTC to it, despite any withdrawals are suspended?
I can't draw any conclusion with certainty, but all this look strange to me. Whale Alert marked 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h as OKEx addresses, and OKEx keep transferring BTC from their hot addresses to 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR, which they still didn't make any comment on.
1. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR belongs to OKEx, that means they withdraw the funds to 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h. As stated by Jay Hao (OKEx) and Philip Gradwell (Chainalysis), 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h doesn't belong to OKEx, which brings us to the conclusion that OKEx are tranferring funds to some dubious address while any withdrawals are officially suspended.
2. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR does NOT belong to OKEx, this also means they are withdrawing funds to a foreign address.
3. If both 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belong to OKEx, then Jay Hao (OKEx) and Philip Gradwell (Chainalysis) LIED in public.
Perhaps some of you know any other blockchain trackers that could enable us to verify the information above.On October 16, OKEx announced they'd been out of touch with one of their private key holders and thus decided to suspend any withdrawals.
Amidst the panic and lack of information there have been some rumors that OKEx wallets had been devastated by either hackers, Chinese police or the exchange employees, and OKEx had lost control over the private keys, so billions of dollars worth of assets are permanently lost.
The exchange has taken refuge in silence, and THAT'S NOT OK. I decided to conduct my own OSINT investigation on the current exchange wallets condition.
First, I considered some data aggregated by the analyst companies.
According to Glassnode, as of October 19, OKEx has 202732 BTC. The information on another currencies is only available for paid accounts, which I don't have. If anybody has access to this information, check it out.
Screenshots:
https://twitter.com/glassnode/status/1317048711055331329
https://twitter.com/JayHao8/status/1318446481183973376
According to CryptoQuant, as of October 23, OKEx has 100480 BTC, 235.7M USDT, 13.4USDK, 1.3M TUSD, 923.18K DAI. Unfortunately, they don't track any other currencies.
I couldn't find any information about what particular addresses those two companies are tracking. Looks like they don't disclose it.
Next, I checked some blockchain explorers:
1) According to Etherscan.io, as for October 26, OKEx keeps the following reserves:
https://etherscan.io/address/0xa7efae728d2936e78bda97dc267687568dd593f3 (~$64M in ETH):
https://etherscan.io/address/0x6cc5f688a315f3dc28a7781717a9a798a59fda7b (~$300M in ERC20 tokens, including 923.18K DAI).
Other stablecoins were transferred to a separate wallet, which is not marked as belonging to OKEx.
https://etherscan.io/address/0x5041ed759dd4afc3a72b8192c143f72f4724081a (235.7M USDT, 13.4M USDK, 7.4M USDC, 1.3M TUSD, 1.1M PAX).
Thus it could be concluded that OKEx is currently possesses $623M in total, which is consonant to CryptoQuant information. There's been no spending transactions from those addresses since October 16.
2) According to Chain.info, as for October 25, OKEx has 270123.89 BTC (https://chain.info/exchanges/OKEX). There are 54 cold, 14029 hot and 325196 deposit wallets marked as belonging to OKEx, though I don't know how accurate marking is.
Here are OKEx' wallets with the biggest amounts in them:
https://chain.info/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS (cold wallet, 74296 BTC; 2 spending transactions have been performed since October 19!!!)
https://chain.info/38UmuUqPCrFmQo4khkomQwZ4VbY2nZMJ67 (cold wallet, 44736 BTC)
https://chain.info/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx (deposit wallet, 14500 BTC)
https://chain.info/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh (deposit wallet, 11405 BTC)
Since October 16, there have been no spending transactions from other 4, 32 and 9 cold wallets with 5000, 3000 and 2000 BTC in them respectively.
https://chain.info/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2 (hot wallet, 1008 BTC; the funds are still being spent!!!)
https://chain.info/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG (deposit wallet, 1200 BTC)
https://chain.info/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28 (deposit wallet, 844 BTC; the funds are still being spent!!!)
https://chain.info/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS (deposit wallet, 798 BTC)
https://chain.info/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay (deposit wallet, 719 BTC)
https://chain.info/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm (cold wallet, 654 BTC; the funds are still being spent!!!)
https://chain.info/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5 (deposit wallet, 392 BTC; the funds are still being spent!!!)
https://chain.info/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC (deposit wallet, 239 BTC; the funds are still being spent!!!)
https://chain.info/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg (deposit wallet, 200 BTC; the funds are still being spent!!!)
I didn't check other wallets with less than 200 BTC in them.
The conclusion is, given Chain.info marked OKEx addresses accurately, the exchange wallets aren't empty, and OKEx didn't lose control over the private keys (at least the major part of them). However, something about Chain.info remains unclear: the sum of the amounts in the addresses mentioned above is 284991, which contradicts the amount of 270123 indicated on https://chain.info/exchanges/OKEX.
3) Then I checked the addresses on BitInfoCharts.com.
Marked as OKEx wallets:
https://bitinfocharts.com/ru/bitcoin/address/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2
https://bitinfocharts.com/ru/bitcoin/address/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28
https://bitinfocharts.com/ru/bitcoin/address/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5
https://bitinfocharts.com/ru/bitcoin/address/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg
https://bitinfocharts.com/ru/bitcoin/address/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC
https://bitinfocharts.com/ru/bitcoin/address/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm
Marked as Coinbase wallets, not OKEx:
https://bitinfocharts.com/ru/bitcoin/address/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS
https://bitinfocharts.com/ru/bitcoin/address/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx
https://bitinfocharts.com/ru/bitcoin/address/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh
https://bitinfocharts.com/ru/bitcoin/address/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG
https://bitinfocharts.com/ru/bitcoin/address/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS
https://bitinfocharts.com/ru/bitcoin/address/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay
The rest of the addresses marked as 'unknown'.
It's not clear which of the two explorers is right about the ambiguous addresses. You might want to inspect the transactions involving those addresses yourself. For example, I can see a lot of transactions between them and bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2, which is marked as OKEx address on both explorers. However, this circumstance itself doesn't mean anything.
Conclusion: the fact that 1 cold, 1 hot and 4 deposit wallets are marked as OKEx wallets on both explorers suggests they actually belong to OKEx. Hence spending transactions are still being performed from all 6 of them!
An OKEx hot wallet is somehow related to withdrawing BTC to other exchange platforms after October 16:
https://chain.info/2d3f09bacf881d431c6bf8106123ff55f7b177ea037d0ceb397f9ffeffad60c0 (4 BTC sent to Binance on October 23)
https://chain.info/fb1361b99308befb66ecf407b96a16ba3c8255dfb15bfc8e2a76715e5ebcb348 (63 BTC sent to Bitfinex on October 25)
https://chain.info/bf0172dc4225a2c110e0d4701aa3cdc729e2a76bb3fc2520069f8a2827047b14 (11 BTC sent to Bitfinex on October 25)
Those are just a few first transactions that I happened to stumble on.
Examples of withdrawing bofore October 16:
https://chain.info/2eec7f94617fdddb242440094d53c710baf1df18d140f2ec4b951c2d0a7002a4 (277 BTC нa Coinbase 11.08.20)
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f (4 BTC нa Binance 14.10.20)
Conclusion: OKEx have been withdrawing BTC from their hot wallet to other exchanges. However, the purpose of this is not clear. Are they doing cross-exchange arbitrage or is it something much worse than that?
In support of this arbitrage idea, the OKEx deposit wallets (marked so by Chain.info and BitInfoCharts) are being refilled from other exchanges:
https://chain.info/3ad5a813e7df5e3518afb37ff2f9e2b8fb15cab15f65cba1280f9d084aac1cd0 (sent 291 BTC from Huobi on October 23)
https://chain.info/fa15c5d314a5de82e01f995488759eb13c4309e6bba5fa621d6d3acf32cfa0f7 (sent 195 BTC from Binance on October 24)
So, they are possibly doing arbitrage (using their clients' funds?), while everybody is waiting for them to resume withdrawing.
There are also some suspicious addresses that might be related to OKEx:
https://chain.info/1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR
https://chain.info/bc1qeskrez68qp79kjvmx5zlw32s3y9l4dscsnevsf
Related to the same wallet, as both of them are often used as transaction inputs.
Furthermore, they are combined into a single wallet #66388910:
https://bitinfocharts.com/ru/bitcoin/wallet/66388910
The first of them is regularly refilled from an OKEx hot wallet.
The same thing with these two addresses:
https://chain.info/15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h
https://chain.info/bc1q9uxc283pfrfasy8d7ntq3mdqnyvf6hlf4lgclf
Both of them are used as transaction inputs, and are combined into a single wallet #55366140:
https://bitinfocharts.com/ru/bitcoin/wallet/55366140
The first of them is regularly refilled from the wallet #66388910 mentioned above.
And now, we're getting to the most fascinating part. All 4 addresses are marked as OKEx addresses by Whale Alert, and there have been spending transactions from them after October 16! Proofs:
https://twitter.com/whale_alert/status/1317110095290007557
https://twitter.com/whale_alert/status/1317111042883964930
https://twitter.com/whale_alert/status/1317496764010799110
These transactions are on Chain.info:
https://chain.info/46d4fd3ea52a7e54d677cb7523a357f19858887205736d4fc15c6ed9c088968a
https://chain.info/2d74f1674bcae42ab51cb93376877fdf2c75b292e9a2695242bfa29e0735c47b
https://chain.info/da139eca250a46e9fa2bfc706946706816e46838fd5858c1b4990060ba4165a9
Jay Hao, OKEx CEO, denied OKEx being related to the first two addresses:
https://twitter.com/JayHao8/status/1317132370567327744
However, he didn't comment on the last transaction.
Philip Gradwell, chief economist of Chainalysis, also denied that 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belongs to OKEx:
https://twitter.com/philip_gradwell/status/1317120228510359552?s=20
Address 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR was also involved in two big transactions on 14 and 15 of October 2020.
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f
https://chain.info/e83d0f7bab35d01cbf8e7741a6cf4ede499fe35099c017a4df9908197bd8f25f
Both times they sent 5000 BTC from a hot OKEx wallet to this address? which is ~$113 in total.
Those transactions was also spotted on Glassnode:
https://twitter.com/glassnode/status/1317082760700448768
It could therefore be concluded that Glassonde doesn't consider 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR to be an OKEx address. However, if the address has nothing to do with OKEx, why are they still transferring BTC to it, despite any withdrawals are suspended?
I can't draw any conclusion with certainty, but all this looks strange to me. Whale Alert marked 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h as OKEx addresses, and OKEx keep transferring BTC from their hot addresses to 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR, which they still didn't make any comment on.
1. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR belongs to OKEx, that means they withdraw the funds to 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h. As stated by Jay Hao (OKEx) and Philip Gradwell (Chainalysis), 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h doesn't belong to OKEx, which brings us to the conclusion that OKEx are transferring funds to some dubious address while any withdrawals are officially suspended.
2. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR does NOT belong to OKEx, this also means they are withdrawing funds to a foreign address.
3. If both 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belong to OKEx, then Jay Hao (OKEx) and Philip Gradwell (Chainalysis) LIED in public.
I call on everyone who stuck on OKEx being unable to withdraw their funds. We should work together to track the excahnge activity and draw public media attention to it in case they are about to withdraw their clients' funds and do exit scam. Please share and repost this.
Perhaps some of you know any other blockchain trackers that could enable us to verify the information above.
I would also like to appeal to OKEx: why don't you publish an official list of your cold wallets, so people don't have to conjecture about the situation and can verify that the funds are actually safu?
Amidst the panic and lack of information there have been some rumors that OKEx wallets had been devastated by either the hackers, the Chinese police or the exchange employees, and OKEx had lost control over the private keys, so billions of dollars worth of assets are permanently lost.
The exchange has taken refuge in silence, and THAT'S NOT OK. I decided to conduct my own OSINT investigation on the current exchange wallets condition.
First, I considered some data aggregated by the analyst companies.
According to Glassnode, as of October 19, OKEx has 202732 BTC. The information on another currencies is only available for paid accounts, which I don't have. If anybody has access to this information, check it out.
Screenshots:
https://twitter.com/glassnode/status/1317048711055331329
https://twitter.com/JayHao8/status/1318446481183973376
According to CryptoQuant, as of October 23, OKEx has 100480 BTC, 235.7M USDT, 13.4USDK, 1.3M TUSD, 923.18K DAI. Unfortunately, they don't track any other currencies.
I couldn't find any information about what particular addresses those two companies are tracking. Looks like they don't disclose it.
Next, I checked some blockchain explorers:
1) According to Etherscan.io, as for October 26, OKEx keeps the following reserves:
https://etherscan.io/address/0xa7efae728d2936e78bda97dc267687568dd593f3 (~$64M in ETH):
https://etherscan.io/address/0x6cc5f688a315f3dc28a7781717a9a798a59fda7b (~$300M in ERC20 tokens, including 923.18K DAI).
Other stablecoins were transferred to a separate wallet, which is not marked as belonging to OKEx.
https://etherscan.io/address/0x5041ed759dd4afc3a72b8192c143f72f4724081a (235.7M USDT, 13.4M USDK, 7.4M USDC, 1.3M TUSD, 1.1M PAX).
Thus it could be concluded that OKEx is currently possesses $623M in total, which is consonant to CryptoQuant information. There's been no spending transactions from those addresses since October 16.
2) According to Chain.info, as for October 25, OKEx has 270123.89 BTC (https://chain.info/exchanges/OKEX). There are 54 cold, 14029 hot and 325196 deposit wallets marked as belonging to OKEx, though I don't know how accurate marking is.
Here are OKEx' wallets with the biggest amounts in them:
https://chain.info/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS (cold wallet, 74296 BTC; 2 spending transactions have been performed since October 19!!!)
https://chain.info/38UmuUqPCrFmQo4khkomQwZ4VbY2nZMJ67 (cold wallet, 44736 BTC)
https://chain.info/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx (deposit wallet, 14500 BTC)
https://chain.info/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh (deposit wallet, 11405 BTC)
Since October 16, there have been no spending transactions from other 4, 32 and 9 cold wallets with 5000, 3000 and 2000 BTC in them respectively.
https://chain.info/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2 (hot wallet, 1008 BTC; the funds are still being spent!!!)
https://chain.info/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG (deposit wallet, 1200 BTC)
https://chain.info/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28 (deposit wallet, 844 BTC; the funds are still being spent!!!)
https://chain.info/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS (deposit wallet, 798 BTC)
https://chain.info/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay (deposit wallet, 719 BTC)
https://chain.info/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm (cold wallet, 654 BTC; the funds are still being spent!!!)
https://chain.info/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5 (deposit wallet, 392 BTC; the funds are still being spent!!!)
https://chain.info/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC (deposit wallet, 239 BTC; the funds are still being spent!!!)
https://chain.info/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg (deposit wallet, 200 BTC; the funds are still being spent!!!)
I didn't check other wallets with less than 200 BTC in them.
The conclusion is, given Chain.info marked OKEx addresses accurately, the exchange wallets aren't empty, and OKEx didn't lose control over the private keys (at least the major part of them). However, something about Chain.info remains unclear: the sum of the amounts in the addresses mentioned above is 284991, which contradicts the amount of 270123 indicated on https://chain.info/exchanges/OKEX.
3) Then I checked the addresses on BitInfoCharts.com.
Marked as OKEx wallets:
https://bitinfocharts.com/ru/bitcoin/address/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2
https://bitinfocharts.com/ru/bitcoin/address/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28
https://bitinfocharts.com/ru/bitcoin/address/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5
https://bitinfocharts.com/ru/bitcoin/address/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg
https://bitinfocharts.com/ru/bitcoin/address/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC
https://bitinfocharts.com/ru/bitcoin/address/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm
Marked as Coinbase wallets, not OKEx:
https://bitinfocharts.com/ru/bitcoin/address/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS
https://bitinfocharts.com/ru/bitcoin/address/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx
https://bitinfocharts.com/ru/bitcoin/address/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh
https://bitinfocharts.com/ru/bitcoin/address/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG
https://bitinfocharts.com/ru/bitcoin/address/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS
https://bitinfocharts.com/ru/bitcoin/address/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay
The rest of the addresses marked as 'unknown'.
It's not clear which of the two explorers is right about the ambiguous addresses. You might want to inspect the transactions involving those addresses yourself. For example, I can see a lot of transactions between them and bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2, which is marked as OKEx address on both explorers. However, this circumstance itself doesn't mean anything.
Conclusion: the fact that 1 cold, 1 hot and 4 deposit wallets are marked as OKEx wallets on both explorers suggests they actually belong to OKEx. Hence spending transactions are still being performed from all 6 of them!
An OKEx hot wallet is somehow related to withdrawing BTC to other exchange platforms after October 16:
https://chain.info/2d3f09bacf881d431c6bf8106123ff55f7b177ea037d0ceb397f9ffeffad60c0 (4 BTC sent to Binance on October 23)
https://chain.info/fb1361b99308befb66ecf407b96a16ba3c8255dfb15bfc8e2a76715e5ebcb348 (63 BTC sent to Bitfinex on October 25)
https://chain.info/bf0172dc4225a2c110e0d4701aa3cdc729e2a76bb3fc2520069f8a2827047b14 (11 BTC sent to Bitfinex on October 25)
Those are just a few first transactions that I happened to stumble on.
Examples of withdrawing bofore October 16:
https://chain.info/2eec7f94617fdddb242440094d53c710baf1df18d140f2ec4b951c2d0a7002a4 (277 BTC нa Coinbase 11.08.20)
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f (4 BTC нa Binance 14.10.20)
Conclusion: OKEx have been withdrawing BTC from their hot wallet to other exchanges. However, the purpose of this is not clear. Are they doing cross-exchange arbitrage or is it something much worse than that?
In support of this arbitrage idea, the OKEx deposit wallets (marked so by Chain.info and BitInfoCharts) are being refilled from other exchanges:
https://chain.info/3ad5a813e7df5e3518afb37ff2f9e2b8fb15cab15f65cba1280f9d084aac1cd0 (sent 291 BTC from Huobi on October 23)
https://chain.info/fa15c5d314a5de82e01f995488759eb13c4309e6bba5fa621d6d3acf32cfa0f7 (sent 195 BTC from Binance on October 24)
So, they are possibly doing arbitrage (using their clients' funds?), while everybody is waiting for them to resume withdrawing.
There are also some suspicious addresses that might be related to OKEx:
https://chain.info/1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR
https://chain.info/bc1qeskrez68qp79kjvmx5zlw32s3y9l4dscsnevsf
Related to the same wallet, as both of them are often used as transaction inputs.
Furthermore, they are combined into a single wallet #66388910:
https://bitinfocharts.com/ru/bitcoin/wallet/66388910
The first of them is regularly refilled from an OKEx hot wallet.
The same thing with these two addresses:
https://chain.info/15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h
https://chain.info/bc1q9uxc283pfrfasy8d7ntq3mdqnyvf6hlf4lgclf
Both of them are used as transaction inputs, and are combined into a single wallet #55366140:
https://bitinfocharts.com/ru/bitcoin/wallet/55366140
The first of them is regularly refilled from the wallet #66388910 mentioned above.
And now, we're getting to the most fascinating part. All 4 addresses are marked as OKEx addresses by Whale Alert, and there have been spending transactions from them after October 16! Proofs:
https://twitter.com/whale_alert/status/1317110095290007557
https://twitter.com/whale_alert/status/1317111042883964930
https://twitter.com/whale_alert/status/1317496764010799110
These transactions are on Chain.info:
https://chain.info/46d4fd3ea52a7e54d677cb7523a357f19858887205736d4fc15c6ed9c088968a
https://chain.info/2d74f1674bcae42ab51cb93376877fdf2c75b292e9a2695242bfa29e0735c47b
https://chain.info/da139eca250a46e9fa2bfc706946706816e46838fd5858c1b4990060ba4165a9
Jay Hao, OKEx CEO, denied OKEx being related to the first two addresses:
https://twitter.com/JayHao8/status/1317132370567327744
However, he didn't comment on the last transaction.
Philip Gradwell, chief economist of Chainalysis, also denied that 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belongs to OKEx:
https://twitter.com/philip_gradwell/status/1317120228510359552?s=20
Address 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR was also involved in two big transactions on 14 and 15 of October 2020.
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f
https://chain.info/e83d0f7bab35d01cbf8e7741a6cf4ede499fe35099c017a4df9908197bd8f25f
Both times they sent 5000 BTC from a hot OKEx wallet to this address? which is ~$113 in total.
Those transactions was also spotted on Glassnode:
https://twitter.com/glassnode/status/1317082760700448768
It could therefore be concluded that Glassonde doesn't consider 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR to be an OKEx address. However, if the address has nothing to do with OKEx, why are they still transferring BTC to it, despite any withdrawals are suspended?
I can't draw any conclusion with certainty, but all this look strange to me. Whale Alert marked 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h as OKEx addresses, and OKEx keep transferring BTC from their hot addresses to 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR, which they still didn't make any comment on.
1. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR belongs to OKEx, that means they withdraw the funds to 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h. As stated by Jay Hao (OKEx) and Philip Gradwell (Chainalysis), 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h doesn't belong to OKEx, which brings us to the conclusion that OKEx are tranferring funds to some dubious address while any withdrawals are officially suspended.
2. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR does NOT belong to OKEx, this also means they are withdrawing funds to a foreign address.
3. If both 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belong to OKEx, then Jay Hao (OKEx) and Philip Gradwell (Chainalysis) LIED in public.
Perhaps some of you know any other blockchain trackers that could enable us to verify the information above.On October 16, OKEx announced they'd been out of touch with one of their private key holders and thus decided to suspend any withdrawals.
Amidst the panic and lack of information there have been some rumors that OKEx wallets had been devastated by either hackers, Chinese police or the exchange employees, and OKEx had lost control over the private keys, so billions of dollars worth of assets are permanently lost.
The exchange has taken refuge in silence, and THAT'S NOT OK. I decided to conduct my own OSINT investigation on the current exchange wallets condition.
First, I considered some data aggregated by the analyst companies.
According to Glassnode, as of October 19, OKEx has 202732 BTC. The information on another currencies is only available for paid accounts, which I don't have. If anybody has access to this information, check it out.
Screenshots:
https://twitter.com/glassnode/status/1317048711055331329
https://twitter.com/JayHao8/status/1318446481183973376
According to CryptoQuant, as of October 23, OKEx has 100480 BTC, 235.7M USDT, 13.4USDK, 1.3M TUSD, 923.18K DAI. Unfortunately, they don't track any other currencies.
I couldn't find any information about what particular addresses those two companies are tracking. Looks like they don't disclose it.
Next, I checked some blockchain explorers:
1) According to Etherscan.io, as for October 26, OKEx keeps the following reserves:
https://etherscan.io/address/0xa7efae728d2936e78bda97dc267687568dd593f3 (~$64M in ETH):
https://etherscan.io/address/0x6cc5f688a315f3dc28a7781717a9a798a59fda7b (~$300M in ERC20 tokens, including 923.18K DAI).
Other stablecoins were transferred to a separate wallet, which is not marked as belonging to OKEx.
https://etherscan.io/address/0x5041ed759dd4afc3a72b8192c143f72f4724081a (235.7M USDT, 13.4M USDK, 7.4M USDC, 1.3M TUSD, 1.1M PAX).
Thus it could be concluded that OKEx is currently possesses $623M in total, which is consonant to CryptoQuant information. There's been no spending transactions from those addresses since October 16.
2) According to Chain.info, as for October 25, OKEx has 270123.89 BTC (https://chain.info/exchanges/OKEX). There are 54 cold, 14029 hot and 325196 deposit wallets marked as belonging to OKEx, though I don't know how accurate marking is.
Here are OKEx' wallets with the biggest amounts in them:
https://chain.info/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS (cold wallet, 74296 BTC; 2 spending transactions have been performed since October 19!!!)
https://chain.info/38UmuUqPCrFmQo4khkomQwZ4VbY2nZMJ67 (cold wallet, 44736 BTC)
https://chain.info/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx (deposit wallet, 14500 BTC)
https://chain.info/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh (deposit wallet, 11405 BTC)
Since October 16, there have been no spending transactions from other 4, 32 and 9 cold wallets with 5000, 3000 and 2000 BTC in them respectively.
https://chain.info/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2 (hot wallet, 1008 BTC; the funds are still being spent!!!)
https://chain.info/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG (deposit wallet, 1200 BTC)
https://chain.info/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28 (deposit wallet, 844 BTC; the funds are still being spent!!!)
https://chain.info/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS (deposit wallet, 798 BTC)
https://chain.info/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay (deposit wallet, 719 BTC)
https://chain.info/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm (cold wallet, 654 BTC; the funds are still being spent!!!)
https://chain.info/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5 (deposit wallet, 392 BTC; the funds are still being spent!!!)
https://chain.info/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC (deposit wallet, 239 BTC; the funds are still being spent!!!)
https://chain.info/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg (deposit wallet, 200 BTC; the funds are still being spent!!!)
I didn't check other wallets with less than 200 BTC in them.
The conclusion is, given Chain.info marked OKEx addresses accurately, the exchange wallets aren't empty, and OKEx didn't lose control over the private keys (at least the major part of them). However, something about Chain.info remains unclear: the sum of the amounts in the addresses mentioned above is 284991, which contradicts the amount of 270123 indicated on https://chain.info/exchanges/OKEX.
3) Then I checked the addresses on BitInfoCharts.com.
Marked as OKEx wallets:
https://bitinfocharts.com/ru/bitcoin/address/bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2
https://bitinfocharts.com/ru/bitcoin/address/1NYAd6fA2dc5xowuweFUSDRqRTEzDwk28
https://bitinfocharts.com/ru/bitcoin/address/1KneytMTrRzYMWKsq7A41KCya4o4ZReoC5
https://bitinfocharts.com/ru/bitcoin/address/1QEVQEFnR8BzksckP3ahCDtWpWi54cXXVg
https://bitinfocharts.com/ru/bitcoin/address/18XY4c65DavYJxsVem4uqbuUkxqty6GYTC
https://bitinfocharts.com/ru/bitcoin/address/1VERF5rDyVoS4mPCbK68vSGpVo95cAXRm
Marked as Coinbase wallets, not OKEx:
https://bitinfocharts.com/ru/bitcoin/address/3Kzh9qAqVWQhEsfQz7zEQL1EuSx5tyNLNS
https://bitinfocharts.com/ru/bitcoin/address/3DwVjwVeJa9Z5Pu15WHNfKcDxY5tFUGfdx
https://bitinfocharts.com/ru/bitcoin/address/3DVJfEsDTPkGDvqPCLC41X85L1B1DQWDyh
https://bitinfocharts.com/ru/bitcoin/address/35tFJwVKEexyDr3fZicy3YpfQvApndVJXG
https://bitinfocharts.com/ru/bitcoin/address/32pizyEwWzF7r85Dj8dQFbSALuRrN85BhS
https://bitinfocharts.com/ru/bitcoin/address/3LhfhgcYNiCceJrjDuMbYWqxPkKkgDQ4ay
The rest of the addresses marked as 'unknown'.
It's not clear which of the two explorers is right about the ambiguous addresses. You might want to inspect the transactions involving those addresses yourself. For example, I can see a lot of transactions between them and bc1quq29mutxkgxmjfdr7ayj3zd9ad0ld5mrhh89l2, which is marked as OKEx address on both explorers. However, this circumstance itself doesn't mean anything.
Conclusion: the fact that 1 cold, 1 hot and 4 deposit wallets are marked as OKEx wallets on both explorers suggests they actually belong to OKEx. Hence spending transactions are still being performed from all 6 of them!
An OKEx hot wallet is somehow related to withdrawing BTC to other exchange platforms after October 16:
https://chain.info/2d3f09bacf881d431c6bf8106123ff55f7b177ea037d0ceb397f9ffeffad60c0 (4 BTC sent to Binance on October 23)
https://chain.info/fb1361b99308befb66ecf407b96a16ba3c8255dfb15bfc8e2a76715e5ebcb348 (63 BTC sent to Bitfinex on October 25)
https://chain.info/bf0172dc4225a2c110e0d4701aa3cdc729e2a76bb3fc2520069f8a2827047b14 (11 BTC sent to Bitfinex on October 25)
Those are just a few first transactions that I happened to stumble on.
Examples of withdrawing bofore October 16:
https://chain.info/2eec7f94617fdddb242440094d53c710baf1df18d140f2ec4b951c2d0a7002a4 (277 BTC нa Coinbase 11.08.20)
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f (4 BTC нa Binance 14.10.20)
Conclusion: OKEx have been withdrawing BTC from their hot wallet to other exchanges. However, the purpose of this is not clear. Are they doing cross-exchange arbitrage or is it something much worse than that?
In support of this arbitrage idea, the OKEx deposit wallets (marked so by Chain.info and BitInfoCharts) are being refilled from other exchanges:
https://chain.info/3ad5a813e7df5e3518afb37ff2f9e2b8fb15cab15f65cba1280f9d084aac1cd0 (sent 291 BTC from Huobi on October 23)
https://chain.info/fa15c5d314a5de82e01f995488759eb13c4309e6bba5fa621d6d3acf32cfa0f7 (sent 195 BTC from Binance on October 24)
So, they are possibly doing arbitrage (using their clients' funds?), while everybody is waiting for them to resume withdrawing.
There are also some suspicious addresses that might be related to OKEx:
https://chain.info/1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR
https://chain.info/bc1qeskrez68qp79kjvmx5zlw32s3y9l4dscsnevsf
Related to the same wallet, as both of them are often used as transaction inputs.
Furthermore, they are combined into a single wallet #66388910:
https://bitinfocharts.com/ru/bitcoin/wallet/66388910
The first of them is regularly refilled from an OKEx hot wallet.
The same thing with these two addresses:
https://chain.info/15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h
https://chain.info/bc1q9uxc283pfrfasy8d7ntq3mdqnyvf6hlf4lgclf
Both of them are used as transaction inputs, and are combined into a single wallet #55366140:
https://bitinfocharts.com/ru/bitcoin/wallet/55366140
The first of them is regularly refilled from the wallet #66388910 mentioned above.
And now, we're getting to the most fascinating part. All 4 addresses are marked as OKEx addresses by Whale Alert, and there have been spending transactions from them after October 16! Proofs:
https://twitter.com/whale_alert/status/1317110095290007557
https://twitter.com/whale_alert/status/1317111042883964930
https://twitter.com/whale_alert/status/1317496764010799110
These transactions are on Chain.info:
https://chain.info/46d4fd3ea52a7e54d677cb7523a357f19858887205736d4fc15c6ed9c088968a
https://chain.info/2d74f1674bcae42ab51cb93376877fdf2c75b292e9a2695242bfa29e0735c47b
https://chain.info/da139eca250a46e9fa2bfc706946706816e46838fd5858c1b4990060ba4165a9
Jay Hao, OKEx CEO, denied OKEx being related to the first two addresses:
https://twitter.com/JayHao8/status/1317132370567327744
However, he didn't comment on the last transaction.
Philip Gradwell, chief economist of Chainalysis, also denied that 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belongs to OKEx:
https://twitter.com/philip_gradwell/status/1317120228510359552?s=20
Address 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR was also involved in two big transactions on 14 and 15 of October 2020.
https://chain.info/e857b385793070c2ec1609bda1c0dc006ac5e064abb9c3b0d76afcb26ffabf7f
https://chain.info/e83d0f7bab35d01cbf8e7741a6cf4ede499fe35099c017a4df9908197bd8f25f
Both times they sent 5000 BTC from a hot OKEx wallet to this address? which is ~$113 in total.
Those transactions was also spotted on Glassnode:
https://twitter.com/glassnode/status/1317082760700448768
It could therefore be concluded that Glassonde doesn't consider 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR to be an OKEx address. However, if the address has nothing to do with OKEx, why are they still transferring BTC to it, despite any withdrawals are suspended?
I can't draw any conclusion with certainty, but all this looks strange to me. Whale Alert marked 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h as OKEx addresses, and OKEx keep transferring BTC from their hot addresses to 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR, which they still didn't make any comment on.
1. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR belongs to OKEx, that means they withdraw the funds to 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h. As stated by Jay Hao (OKEx) and Philip Gradwell (Chainalysis), 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h doesn't belong to OKEx, which brings us to the conclusion that OKEx are transferring funds to some dubious address while any withdrawals are officially suspended.
2. If 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR does NOT belong to OKEx, this also means they are withdrawing funds to a foreign address.
3. If both 1KcZqjt5vbmXQuZrx8Us9HHJg4HgYWNkZR and 15sMzCGDJKFxHx7q4qatjqhtYMMVxxMt1h belong to OKEx, then Jay Hao (OKEx) and Philip Gradwell (Chainalysis) LIED in public.
I call on everyone who stuck on OKEx being unable to withdraw their funds. We should work together to track the excahnge activity and draw public media attention to it in case they are about to withdraw their clients' funds and do exit scam. Please share and repost this.
Perhaps some of you know any other blockchain trackers that could enable us to verify the information above.
I would also like to appeal to OKEx: why don't you publish an official list of your cold wallets, so people don't have to conjecture about the situation and can verify that the funds are actually safu?
Jump to: