HTX said on Aug. 18 that an internal review found no official exchange accounts had initiated the small cryptocurrency transfers community members attributed to its wallets. The exchange said it had not conducted any related transfers or testing activities and would not speculate before completing its investigation. It did not set a deadline for its findings.
The controversy started when a user posting under the handle 0xZiye circulated screenshots of small deposits that appeared to originate from addresses linked to HTX. 0xZiye claimed an HTX-linked wallet had sent 7.5 USDT to their Coinbase account and described the transfer as poisoning. 0xZiye added that Coinbase told them the account would be closed unless they could clearly explain the source of the funds.
A community investigation by researcher 0xMoon examined HTX hot wallet 48 directly and found the 7.5 USDT transfers had gone exclusively to Kraken addresses. No transfer landed in a Coinbase account. No second affected user surfaced to corroborate 0xZiye's account, and searches turned up no additional accounts reporting similar deposit-triggered restrictions.
HTX said it is now examining whether blockchain address labels or attribution methods produced a misleading connection to its wallets. The exchange's public statement did not identify the blockchain involved, the specific sending addresses, or the transaction hashes. It also did not disclose how many users reported receiving unexpected deposits or whether any customer assets are at risk.
The U.K. froze HTX's assets on May 26 over suspected dealings with A7 and Garantex, two sanctioned Russian financial firms. That freeze has a direct operational consequence: compliance software at major exchanges now treats any coin linked to HTX addresses as high-risk, even funds a user never requested and cannot control receiving.
That compliance dynamic explains why small, unsolicited deposits from a flagged exchange create account-review requests at platforms like Coinbase and Kraken. A request for information does not mean an account has been permanently frozen. No affected user has published a complete platform notice showing a permanent restriction linked to the 7.5 USDT transfer, and Coinbase has not publicly addressed the reported case.
Address poisoning, as documented by Chainalysis in its security guide, involves an attacker creating a wallet address that closely resembles one a target has previously used. The attacker sends a small or zero-value transaction so the lookalike address appears in the target's transaction history. The goal is to trick the user into copying the planted address later without checking every character. The current reports contain no verified evidence that any recipient subsequently sent assets to a lookalike address, and no losses have been confirmed.
Small unsolicited transfers alone do not establish a poisoning campaign. Investigators would need to confirm that the sending address resembles a trusted counterparty and that the transaction was designed to manipulate a recipient's address history. No blockchain security firm has publicly connected the disputed transfers to a specific operator or confirmed the transfers constitute a poisoning attempt.
A separate and confirmed address-poisoning case resulted in a user losing 100,000 USDT after copying a planted lookalike address from their transaction history. That case included a verified misdirected payment. The activity HTX is currently investigating has produced no equivalent confirmation.
The gap between the viral claim and the on-chain record is wide. 0xZiye said the poisoning came from an HTX-linked wallet to a Coinbase account. The on-chain examination of HTX hot wallet 48 shows 7.5 USDT transfers going only to Kraken addresses. Either the attribution of the sending wallet was wrong, or the destination exchange was misidentified—or both. HTX's own statement acknowledges that address labels or attribution errors may have created a misleading origin trail.
HTX promised to share confirmed findings with the community once its investigation is complete. The statement gave no timeline, named no internal team leading the review, and did not commit to publishing transaction hashes or sending-address data that would allow independent verification. Until that data is public, the on-chain record examined by 0xMoon stands as the only independently checkable evidence in this case—and it does not support the claim that HTX wallets sent 7.5 USDT to a Coinbase user's account.
