Data Shows Millions Leaving Crypto Wallets Tied to Long-Troubled Exchange

The world's largest cryptocurrency exchange Binance has frozen accounts that received more than 93,000 ether from two wallets indirectly linked to the troubled Russian exchange WEX.

The accounts were frozen on October 25, Leah Li, a spokeswoman for Binance, told CoinDesk. The action was taken in response to pleas from WEX users who have been watching the ethereum blockchain, the known location of a public wallet belonging to the WEX exchange, uneasily in recent months while they have been unable to withdraw their funds off the exchange.

These users traced the flow of funds through the ethereum blockchain and concluded that the two wallets that sent the ether to Binance – in 25 transactions from August through October – were controlled by entities related to WEX. The traders have expressed concern that they won't get their money back now that the funds have been moved to Binance.

They are worried because WEX, a successor to the defunct BTC-e exchange that inherited its infrastructure, has not allowed withdrawals for major cryptocurrencies like bitcoin and ether since July. Given a lack of answers or clarity about the state of affairs at WEX, frustrated users began filing police reports with Russian authorities earlier this month.

Hundreds of users appear to be affected by WEX's ongoing withdrawal issues, judging from the size of the Telegram chat groups devoted to discussing the situation; one has more than 1,000 members, another focused on filing police reports has more than 400.

And at least $18 million is now believed to be at risk, based on the market value of the ether that flowed into Binance. The total figure could be higher, since only ether has been spotted leaving WEX-linked wallets so far, and users have been unable to withdraw most other coins for months.

The situation underscores the risks crypto users have long faced when trusting exchanges with their money. WEX opened for business shortly after the U.S. government shut down BTC-e in July 2017, slapping it with a multi-million dollar fine. At launch, WEX founder Dmitrii Vasilev framed the new exchange as a re-launch of BTC-e and said he was working with the old platform's administrator and would restore its customers' balances.

For almost a year, WEX functioned normally and had the full trust of former BTC-e users, some of them told CoinDesk. But the situation has gone quickly south, perhaps best exemplified by the highly inflated prices for many of the exchange's trading pairs.

"Help us to return our money!" a trader named Maxim M. wrote in an Oct. 20 email to Binance and shared with CoinDesk. "If you don't want to follow the path of BTC-e, which was closed down by the authorities following its use in the laundering of cryptocurrency stolen from Mt. Gox, you should suspend all the WEX's wallets and accounts."

Vasilev did not respond to requests for comment for this story.

Binance's Li said the Malta-based exchange was "not familiar with the specific situation at WEX," but "we always investigate user claims thoroughly and we will suspend account access if any unusual activity is detected." She added:

"We are encouraging users who may be impacted to file reports with local law enforcement and ask them to send us case numbers or official notices/letters of investigation. So far, we haven't been provided with any notices yet."

Li later clarified that the freeze is only temporary, saying, "we're only able to freeze accounts for a short time; some sort of letter from law enforcement is required for a longer-term freeze."

Following the money

A CoinDesk review of public ethereum data found that the trail from the two wallets that sent ETH to Binance ultimately leads back to an address that was controlled by BTC-e.

Further, the analysis shows that the BTC-e-tied address is linked, by way of a divergent path of transactions, to the one wallet clearly belonging to WEX.

The BTC-e address is identified as such on Etherscan, a popular ethereum block explorer. Often, exchanges ask Etherscan to attach their brand name to their wallets, and if they can prove they are the real owners, the name gets assigned. Binance's address is similarly labeled, but none of the more than 10 others are in the web of transactions between it and BTC-e.

The series of transactions began on July 29, 2017, when 485,705 ETH was transferred from the BTC-e address in one batch to another address that users believe to be WEX's first wallet.

Subsequently, that address sent 480,000 ETH in 32 large, round-number transactions from September 2017 through January 2018 to a single address.

CoinDesk has confirmed that this wallet, pictured in the image below, belonged to WEX, since six users provided screenshots of their WEX withdrawal transactions – all of which involved the address, 0xb3AAAae47070264f3595c5032eE94b620A583a39.

But this WEX wallet was not the only recipient of ether from BTC-e. Another 184,772 ETH was transferred to the address 0x95cDdecd01856aA896426bd1ee021D87F3A5c199, and from there, smaller portions later traveled through several different addresses.

Eventually, two addresses – each connected to the BTC-e wallet through a different chain of six addresses – sent significant amounts of ETH to the address identified on Etherscan as belonging to Binance.

The first of these wallets sent 78,581 ETH to Binance in about two dozen transactions between August and October. The other wallet sent 14,794 ETH to the exchange in three transactions on October 15, October 18 and October 22.

Maxim, the trader, said Binance's initial response to his alert was discouraging.

"They responded that they can't do anything so far but would watch those wallets carefully," he said.

The text of Binance's response, which Maxim sent to CoinDesk, reads: "Really thanks for your information, we are willing to cooperate with you. But at present it is hard for us to check all the account from WEX and take action. Anyway, we will keep an eye on this issue, if any update please feel free to contact us."

While Binance spokesperson Li said the accounts were frozen on the 25th, this information was apparently not shared with frustrated WEX users until after CEO Zhao Changpeng (CZ) was asked about the issue on Twitter.

On Monday night, a Twitter user going by the name John James tweeted: "WEX cold wallets are moving funds through @binance. Meaning Binance is potentially help launder millions of dollars worth of stolens funds from Wex users. We have proof too. @cz_binance."

CZ responded quickly: "The identified accounts are frozen, please report to law enforcement and have a case number. We will work with LE. This is part of centralization we hate too, dealing with other exchange's mess (we don't even know the details). But we will do what we can."

Drain image via Shutterstock; Address graphs created by Anna Baydakova for CoinDesk