Tracking Down All Tether Funds: ERC20 Edition

Tether Apr 01, 2021

This article's purpose is simple - we're looking to hunt down all of the ERC20 USDT on the blockchain.

While this seems like an insurmountable task, Bitfinex's insistence on sending the lion's share of the minted USDT back to themselves (or another friend like Binance) actually expedited the majority of the work.

This was also done as a "check" on the 'Whalebot Alerts' tool, which has come under considerable criticism over the past few weeks for its omission of various transactions that should have triggered an emission from the bot.

Thus, this report also concludes that 'Whalebot Alerts' is a cleverly placed Trojan Horse.

Defining 'Trojan Horse'

'Trojan Horse' is used as a pejorative term in this context to describe an entity, tool or resource in the blockchain community that positions itself as a way of increasing transparency and oversight in the blockchain space, when its true intentions are to do just the opposite.

'Whalebot Alerts' matches this criteria because, on the surface, it appears to be an automated 'bot' that was designed to send messages to various social media platforms whenever there is a transaction on a given blockchain that exceeds a certain amount (i.e., $5 million in USD value).

Visiting  Whalebot Alerts on Telegram

Whalebot Alerts is on more than one platform, so we're going to zero in on their presence on Telegram, since that there's less noise within a universally muted channel.

The Telegram handle for this bot is: t.me/whalebotalerts

Above is a photo displaying all of the information that the 'Whalebot Alerts' creators elected to include in the "bio" of the bot.

The account itself is not a 'bot' account, as they are defined on Telegram. Instead, 't.me/whalebotalerts' is a Telegram channel where messages are published whenever a transaction exceeds a certain monetary threshold.

When these messages are published, they are supposed to include:

  1. Sender (actual identity of the entity, if known): Whalebot Alerts has failed to identify the senders in numerous instances where the sender's identity is known.
  2. Recipient  (actual  entity name in cases where that's known): Again, Whalebot Alerts has failed to properly identify recipients of transactions where numerous other public sources have had no issue in doing so.
  3. Total Value Transferred: Despite the fact that Whalebot Alerts' purported design dictates that it announce all transactions that exceed a certain threshold, many users have figured out that this is far from true. This artiocl report will also show users that there are some mislabeled entities as well.

Tracking Down a Whalebot Alerts Identified Transaction

Those that decide to visit the 'Whalebot Alerts' Telegram channel directly  (link included above), will most likely notice that the font appears a bit strange (see below):

"Unknown Blockchain" and "Unknown"??

On numerous messages, viewers will notice that there is the inclusion of the words 'Unknown Blockchain' or 'Unknown'.

We're going to isolate one of those messages and show, unequivocally, that there is no conceivable reason for why this tool would be able to identify some entities - but not others.

See below:

Direct Link to Message = https://t.me/whalebotalerts/85284

In the message above we can see a Whalebot Alert where they shouted out a $500M Tether mint on March 20th, 2021.

Specifically, the message from Whalebot Alerts states:

  • The sender was "unknown"
  • This transaction was one that minted the new currency
  • This occurred on Ethereum's blockchain

Examining the Actual Transaction

Fortunately, the one thing that 'Whalebot Alerts' does provide is a link to a block explorer where the transaction in question can be examined more in-depth.

For the one that we isolated above, their link = https://etherscan.io/tx/0x0c9f8c0701548a01050d8b9eaac2fbfbb9fb955a80f2e379dac82283b60b3eec

Upon clicking on the link above, we're taken to the following page:

source: https://etherscan.io/tx/0x0c9f8c0701548a01050d8b9eaac2fbfbb9fb955a80f2e379dac82283b60b3eec

The relevant parts of the contract are boxed in red below:

In the picture above, we can see that the contract being called is labeled as 'Bitfinex: MultiSig 2'; however, that does not mean that Bitfinex are the only ones with permission to make calls on the contract.

We're going to use 'Bloxy' from here to better assess who the primary callers of the contract are.

Based on what can be seen on Etherscan, it appears (from a glance) that the primary caller is Bitfinex:

The other two addresses that can be seen sending funds in are:

A) 0xf4b51b14b9ee30dc37ec970b50a486f37686e2a8

B) 0x61d5a4d5bd270e59e9320243e574288e2a199fed

Before moving on to inspect those addresses though, we're going to change the view of the wallet on Etherscan first.

We're doing this because the 'regular view' of the contract's actions shows us that they were '0 Ether' sent in the transaction:

However, this does not mean that there was nothing at all sent - but rather that ERC20 tokens were sent instead.

In order to access that information, we just need to click the 'ERC20 Token Txns' tab on Etherscan.io, and it should take u s to the correct view from there.

Upon clicking that tab, we're brought to a view that shows us the following:

In the picture above, we can see:

  1. Five separate outgoing transactions
  2. Each transaction is transferring Tether
  3. Each transaction goes to the same address
  4. All transactions in the photo above occurred within the past 21 days.
  5. The total value in Tether sent is $2 Billion.

The recipient address for these transactions is: 0x5754284f345afc66a98fbB0a0Afe71e0F007B949

Breaking Down Wallet 0x5754284f345afc66a98fbb0a0afe71e0f007b949

Our first glance at the wallet's page on Etherscan shows that it is currently holding $667 million in funds.

If we quckly swap over to Bitquery (explorer.bitquery.io; the same folks that own 'Bloxy'), then we can see that over 25B (billion) USDT have been received and sent from this wallet:

source: https://explorer.bitquery.io/ethereum/address/0x5754284f345afc66a98fbb0a0afe71e0f007b949

The wallet's transaction history is relatively erratic as well (see below; back to Etherscan for this part):

So from what we can see above, the address is sending rather large lump sum disbursements of Tether to numerous different addresses.

Fortunately, Bloxy makes it easy for us to quickly parse the entities whom were the most frequent recipients of the Tether by here:

source: https://explorer.bitquery.io/ethereum/address/0x5754284f345afc66a98fbb0a0afe71e0f007b949/outflow ;  we're still looking at the 0x5754284f345afc66a98fbb0a0afe71e0f007b949 address!

From the photo above, we can see that Bitfinex received approximately 7.28 Billion of these tokens (that's what the 'G' denominates on 'Bitquery').

Choosing the Right Software to Analyze Transaction Flow

At this point, we know that at least 7.28 billion USDT have been directly to Bitfinex via this address, but we know nothing about the other addresses yet - so we're going to see what additional information we can glean from those.

For this part of our analysis, we're going to show off a couple of tools that readers can use for free (at the time of writing; no telling what will happen in the future).

Ethtective

This is a solid tool to use if you want to start chasing down connections immediately. It doesn't offer a ton of granular controls for the user out-of-the-box, but it does its intended job really well.

Ethtective Website: https://ethtective.com

Below is a GIF demonstrating the tool in action for those that are curious:

Bitquery Explorer

This tool, hands down, is the probably the best one for heavy duty transaction analysis such as what we're doing here.

The only drawback to this is that its probably more suited for "advanced" user (i.e., people that are really comfortable analyzing and scrutinizing various addresses on different blockchains).

This is the tool that we're going to use to explore the other entities that the 0x575 address has interacted with on the blockchain (specifically for the flow of Tether).

Examining the Address Fund Outflows

As noted above, we elected to go with Bitquery for this portion of the analysis.

Upon inputting the address, selecting the 'Money Flow' tab, then adjusting the parameters for how wallet relationships are shown (i.e., narrowing down TX types & other specificities), we were able to get the tool to render us a rather beautiful graph of the transaction outflow (specifically) from the address.

See below

Notable Observations:

Please Note: Some of the observations made in the list below are not viewable via the screenshot shown above. We will elucidate upon at the conclusion of the list
  1. Nearly all of this address' incoming funds that its received over time (22.3 billion USDT) comes from one fund source (0xc6cde7; this is a smart contract address - just FYI)
  2. There are astronomical disbursements of Tether going to Bitfinex (aside from the 7 Billion tracked thus far) ; there were 627M and 800M USDT sent to the Bitfinex 5 and Bitfinex 1 (and of course, 7.27 Billion USDT sent to Bitfinex Exchange Wallet 4)
  3. Poloniex sent a non-trivial amount to this address as well (325M)
  4. 5.65 Billion USDT went to address 0xf44e17140b4c32ef1e9fab15cbcb14074bd832ee ; that address then forwarded all of those funds directly to Binance (all of them)
  5. 1.608 Billion USDT went to address 0xf36a47300f002c0c9f8c131962f077c3543b2fc6; on top of the 1.7B+ USDT (total; 1.608B still came from our 0x575 address we're tracking), there are 176,354 ETH tokens that were sent as well ($320 million worth at current prices [quite high these days]). In addition there have been 690,715 $LINK tokens ($20.4M worth). There are some other currencies of note that aren't listed within this numbered point for brevity's sake.

Examining Our Original Graph More Closely

To reiterate what was stated at the beginning of the prior section, many of the numbered point above contain information that may not have been readily apparent in the initial screenshot produced above, so let's go ahead and walk down these transactions first to get a better gist for what's going on.

Examining Outflows to Bitfinex Addresses

There's nothing too much more to this portion than what can be seen in the screenshot below:

The wallet labels and totals are shown clearly above.

Funds Received From Poloniex

This is another one that was implicitly obvious in the initial photo - but that doesn't mean that it isn't worth isolating and examining below:

Total Funds Received From Multi-Sig Address

Overall, a total of 23B USDT have been sent from this address:

"What is the Multi-Sig Address?"

Remember in the beginning of this write-up we picked a Whalebot transaction out of the random that we wanted to follow?

Which took us to this page on Etherscan:

On that transaction page, we can see the "recipient" of the transaction was "Bitfinex: MultiSig 2"; however, this is a smart contract address, not a human being - so that means that the address performs a function of some sort.

In most cases on Ethereum, when you interact with a 'smart contract ' (vs. human being), that smart contrac represents some sort of token that was minted on Ethereum.

In this case, that contract is what's responsible for transferring the USDT token to and from various addresses (based on what was specified in the 'call' on the contract).

Which all translates to the following:

We're looking at the call specifically, because that tells us what happened here.

In the screenshot above, we can see that it says 'issue' :

Our work isn't done here because something doesn't make sense.

The 'Bitfinex Multi-Sig 2' address does not have a token  - in fact, it appears that it is a regular functional address (based on its wallet history) - which means that another smart contract was called in this construction that we're not seeing (unless until we get back to Etherscan).

Re-visiting Etherscan

If we go back to the Etherscan transaction page for the TXID, we'll see a panel labeled "logs".

We need to click on that:

Which swaps the pane over to one that looks like the following:

The screenshot above only shows the first part of the page, which contains the sender and anything pertaining to them (usually nothing).

Scrolling down a bit further (to 'index_topic_1'), we'll see that where the "issue" call was actually made:

It was made on this address: 0xdAC17F958D2ee523a2206206994597C13D831ec7

If we check out the Etherscan page for said address, we end up with none other than the infamous, USDT

source: https://etherscan.io/address/0xdac17f958d2ee523a2206206994597c13d831ec7

Which means that the Bitfinex Multi-Sig 2 address is a recipient (even though its a smart contract, too).

Revisiting That Bitfinex Multi-Sig Address

We took a look at this address earlier, but just as another refresher - when we specifically isolated the ERC20 transactions involving the address, we notice a bunch of these transactions were outgoing (to the same address)

source: https://etherscan.io/address/0xc6cde7c39eb2f0f0095f41570af89efc2c1ea828#tokentxns

That address was none other than 0x5754284f345afc66a98fbb0a0afe71e0f007b949. And that's the address that we're currently examining:

source: https://explorer.bitquery.io/ethereum/address/0x5754284f345afc66a98fbb0a0afe71e0f007b949/graph

Additional Observations

Since there are so many interesting connections here and it appears that this wallet address holds the key to us dissecting where all of the USDT on Ethereum have and are being sent to, we may as well continue our initial mission.

Non-Descript Address Receives 1.608 Billion USDT

This address is unlabeled, but the fact that it received >1.6 billion USDT makes it worthy of investigation.

The actual address is 0xf36a47300f002c0c9f8c131962f077c3543b2fc6

Judging by the 'currencies sent/received' panel, it appears that this address has served as the midpoint of transfer for more than what we saw above.

Take a look:

Going back to the transaction graph, this wallet's purpose is not as patently other as the one preceding it:

Another Non-Descript Address Receives 5.65 Billion USDT

Once again an unlabeled address was spotted receiving an exorbitant amount in funds.

However, in this instance the wallet received nearly 5x as much as the one prior:

source: https://explorer.bitquery.io/ethereum/address/0x5754284f345afc66a98fbb0a0afe71e0f007b949/graph

Specifically, the address that received the 5 billion+ USDT is 0xf44e17140b4c32ef1e9fab15cbcb14074bd832ee.

Below is the (super brief) list of currencies this wallet has interacted with:

source : https://explorer.bitquery.io/ethereum/address/0xf44e17140b4c32ef1e9fab15cbcb14074bd832ee

Next, we click on the '16' (hyperlinked above):

Which takes us here, where it is patently obvious that Binance was the primary recipient of all of those funds:

In addition, revisiting the 0x575 address, we found another 800M that's was disbursed directly to Binance:

Thus, in total (so far) it appears that Binance has received 6.45 billion USDT on Ethereum's chain alone (that's quite a lot).

Financial Metrics of Tether Disbursement

Beyond the blockchain, there still exist wonderful resources like 'Tokenview.com' (free, again, like everything else mentioned).

Specifically though, we're going to use this tool to check out the disbursement of USDT to ensure we've left no stones unturned for Ethereum.

See below:

source: https://stablecoin.tokenview.com/en/usdt

In the photo above, we isolated all of the Tether mints made on the Ethereum blockchain.

We can see that each mint was made and disbursed to the 0x575 address that we just got through examining as well (Tether Treasury)

Below is a list of the most recent transactions from the address (isolating USDT):

source: https://eth.tokenview.com/en/tokentxns/0x5754284f345afc66a98fbb0a0afe71e0f007b949

While not shown in the photo above, it is worth noting that there are no "burns" or "redemptions" of USDT (at any point in time).

Rather the tokens just remain in the wallet and are re-distributed at leisure (one can only assume that token are only sent back to the Treasury address to give off th e false impression that there's any legitimate accounting going)

Going back to the Bitfinex Multi-Sig Address, we can see that at one point in time, 3.2 billion USDT were generated in the space of 4 days (at the beginning of February):

source: https://eth.tokenview.com/en/address/0xc6cde7c39eb2f0f0095f41570af89efc2c1ea828

Distribution of ERC20 Tether Since the Beginning of the Bull Market

For those that do not know (or remember), the "bull market" didn't really get under way until roughly around the beginning of October (10/8/2021).

Below are a couple of charts of Bitcoin to serve as a refresher (and validation of this fact):

notice the beginning date is marked in the second photo ; October 10th, 2021

Below is a photo showing the total amount of ERC20 Tether that had been disbursed to exchanges up to that point in the year:

The screenshot above tells us that on October 8th, 2020:

  • Binance had 2.631 billion USDT on hand
  • Bitfinex had 1.7 billion USDT on hand
  • Huobi had 185M on hand
  • "Others" = 4.7 billion'
  • Poloniex = 70M

Let's see what the current values are now (judging by the steep ski slopes representing holdings over time, our guess is a considerable amount)

Turns out we were right.

The screenshot above tells us that on March 30th, 2021:

  • Binance has 6.367 billion USDT
  • Bitfinex has 7.143 billion USDT
  • Huobi is at 245 million USDT
  • "Others" = 12.36 billion USDT
  • Poloniex: 70.09 million USDT

Total Delta (change +/-)

  • Binance acquired 3.73 billion more USDT\
  • Bitfinex acquired 5.443 billion more USDT
  • "Others" received 7.66 billion more USDT

If we add up all of the fund above, we end up with 26.115 billion.

Curiously, if we look at all of the funds that have been minted at the Tether treasury, it appears that only 25 billion have been sent out:

Conclusion

This concludes our (somewhat brief) on-chain analysis of all of the USDT ETH Tether.

For the next part in our series, we're going to take a look at the disbursement of USDT on the Tron blockchain.

Tags

cryptomedication

Happy to serve and help wherever I'm needed in the blockchain space. #Education #EthicalContent #BringingLibretotheForefront

Great! You've successfully subscribed.
Great! Next, complete checkout for full access.
Welcome back! You've successfully signed in.
Success! Your account is fully activated, you now have access to all content.