On-chain analysis: Why is Forbes' report that Binance "misappropriated 1.8 billion USDC" incorrect?

Wu Says Author | Maverick

Wu Says Compiler | Colin Wu, Wu Says Real

Forbes published an article on Monday (27th) accusing Binance of quietly transferring $1.8 billion in stablecoin collateral to hedge funds including Alameda and Cumberland/DRW last year, condemning Binance for misappropriating user assets. The timing of Forbes' article is also quite subtle, as just two weeks prior, Binance was embroiled in controversy over BUSD. This article regarding the misappropriation of user assets has clearly sparked significant public discourse, prompting Binance to respond the next day, stating, "The institutions mentioned in the Forbes article are all spontaneous actions of institutional users transferring funds; Binance has never misappropriated user funds, whether from centralized exchange assets or B-token collateral."

So what is the truth? This article will restore the facts by combining on-chain data and address tags.

Conflict of Interest Statement: This article has no financial ties to the parties mentioned and has not communicated with Binance, Forbes, or other related parties.

Core of the Forbes Article

Original Forbes article:

https://www.forbes.com/sites/javierpaz/2023/02/27/binances-asset-shuffling-eerily-similar-to-maneuvers-by-ftx/?sh=66e46075bccd

The main point of the lengthy Forbes article is about the $1.8 billion stablecoin from last year, and this $1.8 billion is not just one transaction:

The first stablecoin is USDC, referring to the transfer of $1.8 billion USDC from Binance-Peg Tokens (address) to Binance 8 on August 17, 2022, at 13:42, which was later transferred to Amber Group, Alameda, Sun Yuchen, and other addresses via Binance 14 on the 24th. (The $1.8 billion is an approximate figure; the actual amount is $1.779 billion.)

The second stablecoin is BUSD, referring to the transfer of $1.8 billion BUSD from Binance-Peg Tokens to Binance 8 on August 17, 2022, at 13:39, which was then transferred back to Binance-Peg Tokens by Binance 8 on the 23rd. (The $1.8 billion is an approximate figure; the actual amount is $1.854 billion.)

The main point of contention is primarily regarding the first $1.8 billion USDC transaction, so the focus will be on that transaction. The flow of the second $1.8 billion BUSD is relatively straightforward, and it essentially flowed back to its original position, with Forbes not providing much interpretation of this transaction. In the subsequent analysis, the author speculates that the second $1.8 billion BUSD may be a complementary measure to the first $1.8 billion USDC.

Binance-Peg Tokens refers to Binance: BSC-pegged Assets on Nansen, with the former label coming from the Etherscan block explorer, and it will also be referred to as B-P Tokens, assuming it is Ethereum assets.

(Transaction link:

https://etherscan.io/tx/0x09f0c36b09d51f7207109132e3600a3fe928d3eb51fc28e25d92722e0421669d)

(Transaction link:

https://etherscan.io/tx/0x92a093de270a1b86d4ac62cbfb50e2c897792ca6e3225385909030a1add8ce37)

BUSD

According to the label, theoretically, the B-P Tokens address refers to assets that are wrapped/pegged to native chain-issued assets on BSC, such as the most classic and frequently debated BUSD. BUSD is a stablecoin asset issued by Paxos on the Ethereum chain, while the BUSD circulating on BSC is its pegged version. According to a 1:1 pegging relationship, the amount of BUSD held by the B-P Tokens address on Ethereum should theoretically be sufficient to fully cover the supply of BUSD on BSC at any given time. In practice, the pegging is not real-time, and some deviation is normal; periodic rebalancing or updates occur. The most recent instance of the B-P Tokens BUSD balance being significantly lower than the BSC BUSD supply occurred between August 17 and 23 last year, resulting from that $1.8 billion BUSD transfer. At other times, the B-P Tokens BUSD is always approximately equal to or greater than the BSC BUSD supply, and it is not difficult to find that after the $1.8 billion BUSD transfer last year, the gap between the two has also become larger.

Additionally, from the POF reserve addresses disclosed by Binance in November last year, B-P Tokens is one of the important addresses for Binance BUSD (Ethereum) reserves, meaning that the BUSD balance in the B-P Tokens address not only serves as a peg for BSC BUSD (managed by Binance) but also contains a significant portion that belongs to user assets. During the period from August 17 to 23, the changes in the $1.8 billion BUSD in the B-P Tokens address did not cause a noticeable change in the BSC BUSD supply; from this perspective, it may just be a deposit and withdrawal behavior of institutional users. Another possibility, which I will explore further below, will return to the contentious USDC.

USDC

The role of USDC on B-P Tokens is similar; Circle has not issued native USDC on the BSC chain, so the USDC circulating on BSC is actually a pegged asset from the native issuance chain Ethereum. Therefore, the USDC on B-P Tokens pegs the supply of USDC on BSC, and theoretically, like BUSD, the B-P Tokens USDC balance should cover the BSC USDC supply. However, this is not the case.

The USDC balance in the B-P Tokens wallet can be divided into several key nodes:

First, before the $1.8 billion USDC was transferred from B-P Tokens to Binance 8. In the two to three months prior to this point, the B-P Tokens USDC balance was slightly less than the BSC USDC supply.

Second, from the time the $1.8 billion USDC was transferred out of B-P Tokens until before December 6. After the $1.8 billion USDC was transferred out, the B-P Tokens balance became 0 during this time frame, but BSC USDC was still circulating. Was this a state of no pegging? Not necessarily; it is more likely that Binance had other wallets sufficient to cover the USDC assets circulating on BSC, in other words, there were one or more additional wallets for pegging.

Third, from December 6 to the present, Binance 8 transferred back enough USDC assets to B-P Tokens to cover the BSC USDC supply, after which the B-P Tokens USDC balance once again pegged the BSC USDC.

Furthermore, although the B-P Tokens address was not listed as a USDC reserve address in the POF disclosed in November, B-P Tokens is one of the reserve addresses for the two major stablecoins, USDT and BUSD. Therefore, it is inferred that before Binance announced the removal of USDC, the situation of USDC in that address may have been similar to BUSD—existing as both pegged assets and user assets. The difference from BUSD is that the B-P Tokens address may only serve as one of the addresses pegging the BSC USDC supply, because during the long period when the USDC balance in that wallet was zero, BSC USDC was still operational, indicating that there were likely one or more similar addresses with dual identities at some point. Therefore, considering the lack of correlation between the changes in the B-P Tokens USDC balance and the BSC USDC supply, as well as the subsequent flow towards institutions, it is more likely to be an institutional withdrawal behavior.

Possible Truth

In fact, there is currently no evidence to suggest that the transfer of $1.8 billion USDC was an act of misappropriating ordinary user assets; it is more likely a collective withdrawal behavior of institutional users. So why did institutions collectively do similar things at this time? I believe it is likely that, on the eve of USDC's removal, Binance allowed partner institutions to withdraw their USDC first.

On September 5 last year, Binance announced the automatic conversion of USDC to BUSD and the removal of USDC trading pairs. It is worth noting that for USDC, Binance did not take the direct approach of removal but instead converted USDC to BUSD, which could lead to issues such as insufficient collateral or reserves for BUSD generated from large institutional USDC deposits. Allowing institutions to withdraw first was wise. This announcement was made about half a month after August 17, providing institutions with ample time to consider and act. Additionally, looking back at the BUSD transfer that occurred around the same time, this may also be Binance preparing another measure in case institutions really wanted to convert large amounts of USDC to BUSD and temporarily replace the pegging function of BSC BUSD with other cold wallets. Perhaps after clarifying the attitudes of partner institutions, they would transfer it back for pegging.

From the USDC transfer path, B-P Tokens → Binance 8 → Binance 14, this is more likely a conversion process from cold wallet to hot wallet, as Binance prepared for institutional large withdrawals of USDC. From the current perspective, Binance 14 is one of the USDC user asset reserve addresses disclosed by Binance, and based on the nature of the wallet and historical balance, this address is a hot wallet that cannot simultaneously serve the responsibility of pegging BSC USDC, and it is less complex than the assets held by Binance 8, thus it is reasonable for Binance 14 to only serve as a reserve for user assets.

I understand that Forbes' accusation of the large transfer of B-P Tokens assets as misappropriation is a habitual misinterpretation due to labeling. For example, the assets on the Binance-Peg Tokens address have multiple attributes and do not entirely belong to user assets; the main user assets on the B-P Tokens address are USDT and BUSD; while the USDC assets of users are primarily composed of five addresses including Binance 14, 15, and 16. However, on the other hand, this also requires exchanges to better classify and utilize address labels.

Binance-Peg Tokens (B-P Tokens):

0x47ac0Fb4F2D84898e4D9E7b4DaB3C24507a6D503

Binance 8: 0xF977814e90dA44bFA03b6295A0616a897441aceC

Binance 14: 0x28c6c06298d514db089934071355e5743bf21d60

You can verify this based on on-chain data and the POF addresses disclosed by Binance:

https://www.binance.com/en/blog/community/our-commitment-to-transparency-2895840147147652626