HTX users went rogue and start doing AML poisoning attack

[shinratensei_]

https://x.com/WuBlockchain/status/2089644024785477921

There were reports about batches of small stablecoin transactions from HTX to unrelated addresses, even though it might seem like normal transaction but it's actually a problem because HTX is under UK sanction and any HTX related transaction will get your account frozen because it triggers high risk flag from whatever blockchain analytic used by exchange. HTX denied their involvement.

I think this is one of many reasons why risk profiling by blockchain analytics that judge the risk level of an address by connected addresses is faulty, a random transfer from rogue users can get you into predicament. What do you think about this?

[noorman0]

From hot wallet HTX withdraw directly to random wallet? How can users manage batch withdrawals? As far as I know, it has never been in any CEX feature. I suspect that this effort was deliberately facilitated by HTX to disrupt sanctions monitoring.

-snip-
I think this is one of many reasons why risk profiling by blockchain analytics that judge the risk level of an address by connected addresses is faulty, a random transfer from rogue users can get you into predicament. What do you think about this?

Correct, if that logic were applied to the extreme, almost the entire blockchain would eventually become "tainted," given the transparent and permissionless nature of cryptocurrency.

[lvlkey]

The part of this that gets underrated is that receiving is not a consensual act. A user can be careful about where they withdraw to. Anyone who accepts payments cannot: the deposit address is published on purpose, so anybody can send anything to it at any time, and there is no on-chain equivalent of declining an inbound transfer.

That is what makes guilt-by-association scoring structurally unfair to a receiving address. The model treats an inbound edge as if it were a decision, when from the receiver's side it is just something that happened to them. Outbound says something about you. Inbound mostly says something about whoever sent it.

It also quietly punishes a design a lot of shops use, which is a permanent reusable deposit address per account. It is much better UX, the customer saves it once and tops up whenever they want, but it means one poisoned inbound sits on the same address every future payment lands on. The convenience and the exposure come from the same property.

The mitigation that actually works is boring: treat the receiving layer as disposable and sweep. Do not let balances sit anywhere the public can reach, move funds to a settlement wallet you never publish, and rotate receive addresses where the product allows it. But that cost is real, because rotating is exactly what breaks the permanent-address convenience. Anyone presenting a clean answer here probably has not had to pick between the two.

[$crypto$]

From hot wallet HTX withdraw directly to random wallet? How can users manage batch withdrawals? As far as I know, it has never been in any CEX feature. I suspect that this effort was deliberately facilitated by HTX to disrupt sanctions monitoring.

His usual mass withdrawal can not be done, especially with a small amount, I do not know how many withdrawals in HTX? I thought this was like in accidentally but HTX told me possible error in address labeling.

I don't know which one is wrong, it's like there is a correlation with some sanctions received by HTX.

[tokeweed]

Funny how the guys doing the shenanigans think it's gonna work in these times with blockchain analytics.  I mean if my wallet got hit with a transaction from HTX and say Binance sees that somebody is dusting random wallets with dirty HTX transactions then wouldn't Binance see through the shenanigans and not ban my wallet? 

It's so stupid.

[MAAManda]

Funny how the guys doing the shenanigans think it's gonna work in these times with blockchain analytics.  I mean if my wallet got hit with a transaction from HTX and say Binance sees that somebody is dusting random wallets with dirty HTX transactions then wouldn't Binance see through the shenanigans and not ban my wallet?

That is how it should be, CEXs needs to know whether there's genuine intent behind the transaction. If the transaction isn't a large one, the CEX should be able to assess that someone might simply be acting out of mischief, attempting to compromise accounts on the platform. Transactions under $10 might be considered casual or frivolous, whereas a transaction exceeding $100, for instance, can be seen as a truly serious one. The CEX needs to be wise here.

[elda34b]

Transactions under $10 might be considered casual or frivolous, whereas a transaction exceeding $100, for instance, can be seen as a truly serious one. The CEX needs to be wise here.

I wonder if someone has done the same before. Sending $100 to some random address to get it flagged even though the user never actually used the blocked services at all. Sounds kind of terrible, but what if they have a lot of money to burn to reduce the scoring results from AML profilers? I guess you could say the cost would be too great if they can't recover it in some form.

[Orpichukwu]

I wonder if someone has done the same before. Sending $100 to some random address to get it flagged even though the user never actually used the blocked services at all. Sounds kind of terrible, but what if they have a lot of money to burn to reduce the scoring results from AML profilers? I guess you could say the cost would be too great if they can't recover it in some form.

No matter how small the amount is, if it's coming from a flagged depositing address, the exchange system will capture and flag it, the type of explanation and evidence given to the exchange will determine how they treat such a case, but in situations where the amount could be considered reasonable, since some bad actors can go to any length to risk implicating a target if the exchange is reasonable if the victims explain not to have any connections or whatsoever with the transactions they can withhold that particular input and free the account from being frozen.

[shinratensei_]

Funny how the guys doing the shenanigans think it's gonna work in these times with blockchain analytics.  I mean if my wallet got hit with a transaction from HTX and say Binance sees that somebody is dusting random wallets with dirty HTX transactions then wouldn't Binance see through the shenanigans and not ban my wallet?  

It's so stupid.

The problem is some CEXs don't really give a damn though, they simply do what they're told to do which is freezing a high risk flagged account which logically going to have some false positive like this one. The CEXs going to review compliance and ask for another KYC verification regardless because they don't want to be penalized and want to save their asses and their business.

[hugeblack]

This is why it is best to avoid using KYCed centralized exchanges or at least not post your deposit addresses publicly.
If a similar situation happens to you, you will be asked about proof of funds, so be prepared with this information.

[avp2306]

This is why it is best to avoid using KYCed centralized exchanges or at least not post your deposit addresses publicly.
If a similar situation happens to you, you will be asked about proof of funds, so be prepared with this information.

I'm actually curious how it happen and I find this articles on which Justin Sun denies that incident.

https://nulltx.com/on-chain-data-contradicts-viral-htx-poisoning-claims-justin-sun-says-story-was-fabricated

https://www.cryptopolitan.com/justin-sun-calls-htx-reports-made-up

So with the statement drop by Justin Sun, it seems that there's someone try to sabotage them.

But also, I agree on your opinion that we should not post our exchange address anywhere. Because there's a chance that said incident might going to happen if we are not careful sharing those kind of details.