Binance can’t keep the story straight on misplaced $1.8B USDC

A new and detailed investigation by Forbes has raised significant questions about the management and custody of customer funds and stablecoin securities by Binance. There are many possible explanations for the nature and intent of certain transactions in the chain highlighted by Forbes, and they may be completely harmless. But Binance’s so far confused and sometimes contradictory response to the findings does not inspire confidence, especially in a post-FTX era with rightfully widespread suspicion of centralized custodians with off-chain balances.

This article is taken from The Node, CoinDesk’s daily roundup of the top stories in blockchain and crypto news. You can subscribe to get the whole newsletter here.

Forbes reported this week that in a single day, August 17, 2022, $1.78 billion worth of collateral was moved out of Binance wallets intended to support stablecoins, specifically b-USDC, a wrapped version of Circle’s USDC. According to Forbes’ on-chain analysis, which Binance has not disputed, $1.2 billion of this was sent to trading firm Cumberland DRW, while other amounts went to now-collapsed hedge fund Alameda Research, Tron founder Justin Sun, and crypto infrastructure and services firm Amber Group.

Crucially, according to Forbes, this outflow was not accompanied by a corresponding reduction in the circulating supply of b-USDC tokens.

Binance’s various attempts to provide an innocuous explanation for Forbes’ findings have not provided a unified and consistent – ​​​​far less convincing – rationale for what at worst could indicate misuse of customer funds. Before publishing a more focused and detailed account on Wednesday morning, Binance officials offered a number of different, even conflicting, explanations. Just as annoyingly, Binance’s response still has the petulant and defensive tone of many of the earlier dismissals of close investigative attention.

Forbes’ investigation was motivated by more evidence of past problems with Binance’s asset management practices. Binance has admitted to Bloomberg that for certain periods it was unable to maintain a clear 1:1 support for its wrapped b-assets in a segregated and transparent manner. In this context, the exchange’s attempt to paint an act of journalistic analysis as “conspiracy theories”, while suggesting that the investigation was motivated by nothing more than “gathering a lot of views and clicks”, is beneath the dignity of an organization that hopes to maintain a leadership position in an industry with high risk and fraud.

Binance CEO Changpeng Zhao even retreated to the oldest refuge of scrutinized crypto organizations, declaring that Forbes was reporting nothing more than “FUD” or fear, uncertainty and doubt. But this lazy, knee-jerk dismissal ignores, now as always, a simple reality: Unclear or incomplete answers from the people most obligated to have them are far more serious sources of confusion and anxiety than accepted facts and reasonable questions raised by journalists .

The least charitable interpretation of the Forbes findings, articulated as a hypothetical by Lumida CEO and co-founder Ram Ahluwalia on CoinDesk’s “First Mover” program Tuesday, is that Binance was engaged in some form of rehypothecation. That is, the funds backing b-USDC were lent to counterparties or otherwise put at risk. Based on this possibility, Forbes compared its findings to the bad practices that led to the collapse of FTX.

This was largely the claim of research firm ChainArgos in a January 2nd report that first drew attention to the unusual activity. “Someone received a loan of something like $1 billion for about 100 days,” ChainArgos claimed. “It’s not clear exactly what happened … but this is very large, very obviously manual and very recent.”

Another theory, suggested in Forbes’ reporting, is that instead of high-risk rehypothecation, the net effect of the transaction was to exchange USDC for BUSD issued by Paxos (these events predate a recent order by the New York Department of Financial Services that stopped the issuance). This would have allowed Binance rather than Circle to collect the rising interest on instruments including US Treasuries that back stablecoins. This would be a perfectly rational business move, but could mean that at points b-USDC was effectively backed by BUSD rather than USDC.

Binance has firmly denied that any similar rehypothecation has occurred. But the exchange initially gave incorrect explanations of what actually happened.

During the investigation, Forbes interviewed Patrick Hillmann, Binance’s Chief Strategy Officer. Hillmann’s explanation, included in the original story, appeared to be simply that the on-chain wallets understood to contain support for Binance’s stablecoins are actually meaningless. “There was no commingling” of client funds, Hillman told Forbes, because “there are wallets and then there is a ledger.” According to Hillman, this internal off-chain ledger is what really tracks assets owned or covered by Binance, with on-chain wallets acting as, in his words, mere “containers.”

As Forbes points out, this appears to undermine Binance’s claims of transparency, instead forcing customers to simply trust the exchange to handle their money responsibly. While the various responses repeatedly cite a new proof-of-reserve system as a counter-evidence to suspicion, the transactions in question predate this system, undermining this argument. While Binance has a long track record as a reliable custodian, this seems to turn a blind eye to the new environment of paranoia and mistrust following the collapse of FTX.

Further complicating the picture, a Binance spokesperson wrote the following in a statement to CoinDesk on Tuesday, arguably contradicting elements of Hillmann’s claims to Forbes.

“Binance does not, and has never, invested or otherwise distributed user assets without consent in accordance with the terms of specific products. Binance holds all of its clients’ assets in segregated accounts that are identified separately from any accounts used to hold assets belonging to Binance.”

Note that the spokesperson here refers to “holding” customer funds “in segregated accounts”, not tracking them on an internal ledger. Contra Hillman’s previous claims to Forbes, Binance here strongly suggests that customer funds are kept in separate wallets on the chain. This implication will itself be contradicted before all is said and done.

“The on-chain transactions identified” by Forbes, the spokesperson continued, “related to internal wallet management. While Binance has previously acknowledged that wallet management processes for Binance-connected token security have not always been flawless, at no time was the security of user assets affected. Processes for managing our collateral loan books have been fixed on a long-term basis and this can be verified in the chain.”

Next, on the morning of February 28, Binance CEO Changpeng Zhao took to Twitter to push back against Forbes’ findings. His explanation differed from those previously offered by a C-suite executive and his communications team. Hillman argued that the on-chain transactions highlighted by Forbes didn’t matter, with all the real accounting under the hood. A spokesperson for Binance told CoinDesk that they were part of “internal rebalancing.” But Zhao characterized them as “some old blockchain transactions that our customers have done.”

“Our users are free to withdraw their assets whenever they want,” he continued. “Their withdrawals are turned into ‘received hundreds of millions of shifted security.’

This explanation doesn’t quite pass the smell test even on its own terms. First, describing these as “blockchain transactions” reads like an attempt to suggest that they weren’t brokered by Binance at all. This would directly contradict the characterization of the transactions as “internal rebalancing.” Furthermore, Zhao’s characterization suggests that Cumberland DSW alone owned or managed $1.2 billion worth of USDC mirrored as b-USDC on Binance, then cashed it all out on the same day – a decidedly unusual circumstance.

A more reasonable inference would be that the large transaction to Cumberland represents a chain reconciliation of a large number of customer movements over time, which would make it both a “rebalancing” and a “customer withdrawal.” But none of Binance’s responses expressly make that claim.

The rest of the CEO’s thread reiterates Binance’s track record and cites Binance’s recent implementation of a proof-of-reserve system – although this process has had its share of missteps.

He also writes that “my Chinese ethnicity is brought up again” in the Forbes article, “as if it mattered.” Zhao has arguably been unfairly targeted because of his ethnicity in the past, particularly in attempts to forge links between him and the Chinese government. But the Forbes article correctly refers to him as “Chinese Canadian,” and does so only once, when introducing him. The words “China” or “Chinese” do not otherwise appear in the play. At least in this case, Zhao’s complaint looks like a pretty baseless attempt to distract from and discredit the report’s actual findings.

After offering three divergent characterizations of Forbes’ findings (which facts, it must be emphasized, they did not dispute), Binance finally released what appears to be its definitive statement on March 1, a blog post titled “How and Why Assets Move between Binance wallets.”

The post still includes its share of confusion, but at least lands on a simple explanation for Forbes’ findings: The moves were “just a case of institutional clients pulling their own assets from our platform.” This claim comes with very little detail, and invites further scrutiny that it may or may not bear.

The post does not refute the core finding, by Forbes and others, that the “plug wallet” intended to support various wrapped assets has repeatedly been outside of its proper level of security. For example, it does not explicitly state that backing funds for b-USDC were simply held elsewhere in Binance’s chain custody system. Instead, the post settles for the vague claim that “at no point was the security of user assets affected” by peg wallet mismanagement.

The statement essentially reiterates Hillman’s initial point that chain accounts managed by Binance do not necessarily match real customer balances. This is common practice among crypto exchanges, but in this context amounts to hand-waving. The post broadly refers to “a large network of hot, cold and deposit wallets” and to “the fact that the movement of funds between wallets can serve a variety of purposes.” The point sometimes seems to be “you wouldn’t really understand even if we explained it to you.”

Binance also has a disjointed stance on journalism and oversight. On the one hand, the exchange claims its transparency and says it welcomes scrutiny. It also admits again that in the (relatively recent) past it has failed to manage associated assets. This would seem to warrant increased scrutiny — but the post also repeatedly denigrates journalists as little more than clickbait-hungry, conspiracy-theorizing ambulance chasers.

After the collapse of FTX, the Celsius Network, and half a dozen other apparent scams, this perspective is deeply out of touch with the concerns of crypto investors and users. These concerns have manifested in meaningful outflows from Binance custody and assets over the past month.

It’s unclear whether Binance’s vague, defensive, sometimes confusing response to the latest round of scrutiny is sufficient to assuage those concerns.