HTX users went rogue and start doing AML poisoning attack

[shinratensei_]

https://x.com/WuBlockchain/status/2089644024785477921

There were reports about batches of small stablecoin transactions from HTX to unrelated addresses, even though it might seem like normal transaction but it's actually a problem because HTX is under UK sanction and any HTX related transaction will get your account frozen because it triggers high risk flag from whatever blockchain analytic used by exchange. HTX denied their involvement.

I think this is one of many reasons why risk profiling by blockchain analytics that judge the risk level of an address by connected addresses is faulty, a random transfer from rogue users can get you into predicament. What do you think about this?

[noorman0]

From hot wallet HTX withdraw directly to random wallet? How can users manage batch withdrawals? As far as I know, it has never been in any CEX feature. I suspect that this effort was deliberately facilitated by HTX to disrupt sanctions monitoring.

-snip-
I think this is one of many reasons why risk profiling by blockchain analytics that judge the risk level of an address by connected addresses is faulty, a random transfer from rogue users can get you into predicament. What do you think about this?

Correct, if that logic were applied to the extreme, almost the entire blockchain would eventually become "tainted," given the transparent and permissionless nature of cryptocurrency.

[lvlkey]

The part of this that gets underrated is that receiving is not a consensual act. A user can be careful about where they withdraw to. Anyone who accepts payments cannot: the deposit address is published on purpose, so anybody can send anything to it at any time, and there is no on-chain equivalent of declining an inbound transfer.

That is what makes guilt-by-association scoring structurally unfair to a receiving address. The model treats an inbound edge as if it were a decision, when from the receiver's side it is just something that happened to them. Outbound says something about you. Inbound mostly says something about whoever sent it.

It also quietly punishes a design a lot of shops use, which is a permanent reusable deposit address per account. It is much better UX, the customer saves it once and tops up whenever they want, but it means one poisoned inbound sits on the same address every future payment lands on. The convenience and the exposure come from the same property.

The mitigation that actually works is boring: treat the receiving layer as disposable and sweep. Do not let balances sit anywhere the public can reach, move funds to a settlement wallet you never publish, and rotate receive addresses where the product allows it. But that cost is real, because rotating is exactly what breaks the permanent-address convenience. Anyone presenting a clean answer here probably has not had to pick between the two.

[$crypto$]

From hot wallet HTX withdraw directly to random wallet? How can users manage batch withdrawals? As far as I know, it has never been in any CEX feature. I suspect that this effort was deliberately facilitated by HTX to disrupt sanctions monitoring.

His usual mass withdrawal can not be done, especially with a small amount, I do not know how many withdrawals in HTX? I thought this was like in accidentally but HTX told me possible error in address labeling.

I don't know which one is wrong, it's like there is a correlation with some sanctions received by HTX.

[tokeweed]

Funny how the guys doing the shenanigans think it's gonna work in these times with blockchain analytics.  I mean if my wallet got hit with a transaction from HTX and say Binance sees that somebody is dusting random wallets with dirty HTX transactions then wouldn't Binance see through the shenanigans and not ban my wallet? 

It's so stupid.

[MAAManda]

Funny how the guys doing the shenanigans think it's gonna work in these times with blockchain analytics.  I mean if my wallet got hit with a transaction from HTX and say Binance sees that somebody is dusting random wallets with dirty HTX transactions then wouldn't Binance see through the shenanigans and not ban my wallet?

That is how it should be, CEXs needs to know whether there's genuine intent behind the transaction. If the transaction isn't a large one, the CEX should be able to assess that someone might simply be acting out of mischief, attempting to compromise accounts on the platform. Transactions under $10 might be considered casual or frivolous, whereas a transaction exceeding $100, for instance, can be seen as a truly serious one. The CEX needs to be wise here.