Did the WBTC DAO approve Justin Sun’s HTX as a merchant?
Wrapped Bitcoin (WBTC) spent years marketing itself as being governed by decentralized autonomous organizations (DAOs) that would have oversight over many parts of the product, including “the addition and removal of merchants and custodians.”
Its whitepaper claimed that “signatures are required from DAO members in order to add/remove members.”
Even as recently as a few months ago, WBTC has continued to emphasize that it “operates through a DAO.”
However, this supposed role of the WBTC DAO hasn’t always been respected.
HTX, formerly Huobi, was added as a merchant, the product’s term for an entity who can initiate mints and burns of WBTC, however, it was not approved by the DAO members listed on the Github, but a different set of signers from a different multisignature wallet.
A review of the smart contract reveals that 0xbE6d2444a717767544a8b0Ba77833AA6519D81cD is one of the merchants returned by the “getMerchants” function.
Read more: Is HTX redeeming 80% of TrueUSD?
This address was listed as HTX on the WBTC dashboard in late 2024 when Protos reported on it being used to redeem approximately half a billion dollars worth of WBTC.
However, this address isn’t listed as one of the merchants on the WBTC DAO GitHub page.
HTX is listed as one of the merchants on the WBTC website.
The entities that are still listed on GitHub include defunct and fraudulent entities such as Alameda Research and Three Arrows Capital, both of which are also still listed on the smart contract.
By further reviewing blockchain transactions on Ethereum, we can identify that this address was added as a merchant in November 2024, approximately two months after BiT Global and Justin Sun got involved in WBTC.
Read more: WBTC relaunches on TRON, but abandoned version is bigger
At the time, this transaction came from 0x4dbbbFb0e68bE9D8F5a377A4654604a62E851e80.
Strangely, this address isn’t listed as one of the multisignature wallets for WBTC on GitHub.
The listed multisignature wallet doesn’t include any transactions for the day when HTX was added as a merchant.
The inclusion of HTX as a merchant becomes increasingly important in light of some of the problematic behaviors that the exchange is engaged in.
Read more: Justin Sun defends HTX while it lends 92% of its USDT on Aave
It appears the publicly disclosed multisignature wallet, 0xB33f8879d4608711cEBb623F293F8Da13B8A37c5, appears to have been quietly replaced with a brand new multisignature wallet.
The wallet that was used lists several owners, many of whom differ from the WBTC DAO Github:
- 0xFDF28Bf25779ED4cA74e958d54653260af604C20 — Listed as Kyber on the Merchants list on the GitHub, isn’t listed as a DAO member.
- 0xb0F42D187145911C2aD1755831aDeD125619bd27 — Listed as BitGo on the custodian part of the GitHub, isn’t listed as a DAO member on the current GitHub commit, is listed as a small DAO member on a pull request.
- 0xd5d4aB76e8F22a0FdCeF8F483cC794a74A1a928e — Not listed on the current GitHub commit, is mentioned in a pull request as Maker.
- 0xB9062896ec3A615a4e4444DF183F0531a77218AE — Listed as Aave on the Merchants list on the GitHub, is not listed as a DAO member on the current commit, and is mentioned as a small DAO member on a pull request.
- 0xddD5105b94A647eEa6776B5A63e37D81eAE3566F — Not listed on the current GitHub commit, is listed on a pull request as Tom Bean and is listed as a small DAO member there, multisignature wallet that includes:
- 0x97788A242B6A9B1C4Cb103e8947df03801829BE4 — Not listed on the GitHub at all.
- 0x59150a3d034B435327C1A95A116C80F3bE2e4B5E — Not listed on the GitHub at all.
- 0x926314B7c2d36871eaf60Afa3D7E8ffc0f4F9A80 — Not listed on the current GitHub commit, appears to be a multisignature wallet created using BitGo’s technology, and is listed as BitGo 2 on a pull request describing it as a member of the small DAO.
- 0x51c44979eA04256f678552BE65FAf67f808b3EC0 — Not listed on the current GitHub commit, appears to be another multisignature wallet created using BitGo’s technology, is listed as BitGo 3 on a pull request describing it as a member of the small DAO.
- 0x0940c5bcAAe6e9Fbd22e869c2a3cD7A21604ED8D — Not listed on the GitHub at all.
- 0x5DCb2Cc68F4b975E1E2b77E723126a9f560F08E8 — Not listed on the GitHub at all.
It is not clear why these changes aren’t reflected on the current version of the GitHub repository. Protos reached out to WBTC for some clarification, but it didn’t respond before publication.
By further reviewing the smart contract at 0x4dbbbFb0e68bE9D8F5a377A4654604a62E851e80, we can identify the five addresses that approved the listing of HTX:
- 0xFDF28Bf25779ED4cA74e958d54653260af604C20 — Kyber
- 0xb0F42D187145911C2aD1755831aDeD125619bd27 — BitGo
- 0xddD5105b94A647eEa6776B5A63e37D81eAE3566F — Tom Bean
- 0x926314B7c2d36871eaf60Afa3D7E8ffc0f4F9A80 — BitGo
- 0x51c44979eA04256f678552BE65FAf67f808b3EC0 — BitGo
This means that although this multisignature wallet requires five signatures, three of them came from the same entity.
Only two non-custodian entities approved the addition of HTX as a merchant and those aren’t currently listed as DAO members on GitHub.
Adding to the intrigue, Tom Bean’s project, bZx, was built on Kyber.
It’s also worth highlighting the fact that this multisignature wallet requires five signatures, BitGo controls three, and there are two addresses that aren’t listed at all on GitHub.
If those are controlled by BitGo or BiT Global, then it would be possible for the custodians to make changes without approval from a single additional WBTC DAO member.
Protos reached out to WBTC to determine the identity of those two addresses, but again, didn’t get a response before publication.
BiT Global was added without WBTC DAO approval
This isn’t the first time that WBTC has appeared to ignore the advertised role of its DAO.
The whitepaper for WBTC claimed that “addition/removal of custodians” would be controlled by this DAO.
This used to be echoed on the website, which claimed, “The addition and removal of merchants and custodians will be an open process controlled by a multi-signature contract.”
Read more: Coinbase to delist WBTC months after Justin Sun controversy
Mike Belshe, the chief executive of BitGo, also claimed when BiT Global was being installed that there was a large DAO that “owns the smart contract” and “picks, you know, how we do custody of this thing.”
Strangely, despite that claim, the WBTC DAO didn’t seem to be consulted on the addition of Sun-affiliated BiT Global as a custodian for WBTC.
The Github for the WBTC DAO still doesn’t list BiT Global as a custodian.
The website for WBTC does list BiT Global as one of the custodians, alongside BitGo and BitGo Singapore.
The “members” smart contract still only lists a single custodian, 0xb0F42D187145911C2aD1755831aDeD125619bd27, a BitGo address.
This address is a multi-signature, so it’s possible that BiT Global was added as a signer to this wallet, meaning that the smart contract did not need to be updated with a new custodian address.
Broadly, despite the fact that WBTC manages over $8 billion in value, it seems to have neglected and ignored the DAO that has frequently been an important part of its marketing.
It’s replaced the multisignature wallet that governs it, without updates, with members whose identity we do not know.
This replacement made it possible, or convenient, for HTX to be added as a merchant, but other problems have been ignored, such as the fact that both Alameda Research and Three Arrows Capital are included as merchants.
The large DAO was apparently bypassed regarding the addition of BiT Global.
However it is that WBTC operates, it’s not principally through its DAO.
Its claims of transparency and decentralization have been dashed against the difficulty of coordinating a variety of actors around the world.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.