Wrapped Bitcoin (WBTC) has spent years marketing itself as being managed by a decentralized autonomous organization (DAO) that oversees many parts of the product, including “adding and removing merchants and custodians.”
That whitepaper claims that “adding/removing members requires a DAO member’s signature.”
Until just a few months ago, WBTC continued to emphasize that it was “operated through a DAO.”
However, this assumed role of the WBTC DAO is not always respected.
HTX (formerly Huobi) was added as a merchant, a product term for an entity that can initiate mints and burns of WBTC, but it was not authorized by the DAO members listed on Github, but by a different set of signers on a different multi-signature wallet.
If you check the smart contract, you will see that 0xbE6d2444a717767544a8b0Ba77833AA6519D81cD is one of the merchants returned by the “getMerchants” function.
Read more: Will HTX redeem 80% of TrueUSD?
This address was listed as HTX on the WBTC dashboard at the end of 2024 when Protoss reported that it was being used to redeem approximately $500 million worth of WBTC.
However, this address is not listed as one of the sellers on the WBTC DAO GitHub page.
HTX is listed as one of the participating merchants on the WBTC website.
Entities still listed on GitHub include defunct and fraudulent entities such as Alameda Research and Three Arrows Capital, both of which are still listed in smart contracts.
Further investigation of blockchain transactions on Ethereum reveals that this address was added as a seller in November 2024, approximately two months after BiT Global and Justin Sun became involved with WBTC.
Read more: WBTC reboots with TRON, but abandoned version is bigger
At the time, this transaction was sent from 0x4dbbbFb0e68bE9D8F5a377A4654604a62E851e80.
Strangely, this address is not listed as one of WBTC’s multi-signature wallets on GitHub.
The multi-signature wallets listed do not include transactions from the day HTX was added as a seller.
Including HTX as a seller has become increasingly important given some of the questionable practices that exchanges are engaging in.
Read more: Justin Sun defends HTX, lends 92% of USDT to Aave
The publicly available multi-signature wallet 0xB33f8879d4608711cEBb623F293F8Da13B8A37c5 appears to have been secretly replaced by a new multi-signature wallet.
The wallets used have multiple owners listed, many of which are different from the WBTC DAO Github.
- 0xFDF28Bf25779ED4cA74e958d54653260af604C20 — Listed as Kyber in the merchant list on GitHub, but not as a DAO member.
- 0xb0F42D187145911C2aD1755831aDeD125619bd27 — Listed as BitGo in the admin part of GitHub, but not listed as a DAO member in the current GitHub commit and listed as a small DAO member in the pull request.
- 0xd5d4aB76e8F22a0FdCeF8F483cC794a74A1a928e — Not listed in the current GitHub commit, but mentioned as Maker in the pull request.
- 0xB9062896ec3A615a4e4444DF183F0531a77218AE — Listed as Aave in the merchant list on GitHub, but not listed as a DAO member in the current commit and mentioned as a small DAO member in the pull request.
- 0xddD5105b94A647eEa6776B5A63e37D81eAE3566F — Not listed in the current GitHub commit, but listed as Tom Bean in the pull request, where he is listed as a small DAO member. A multi-signature wallet that includes:
- 0x97788A242B6A9B1C4Cb103e8947df03801829BE4 — Not listed at all on GitHub.
- 0x59150a3d034B435327C1A95A116C80F3bE2e4B5E — Not listed at all on GitHub.
- 0x926314B7c2d36871eaf60Afa3D7E8ffc0f4F9A80 — Although not listed in the current GitHub commit, it appears to be a multi-signature wallet created using technology from BitGo, listed as BitGo 2 in the pull request and described as a member of a small DAO.
- 0x51c44979eA04256f678552BE65FAf67f808b3EC0 — Although not listed in the current GitHub commit, it appears to be another multi-signature wallet created using BitGo’s technology, listed as BitGo 3 in a pull request described as a member of a small DAO.
- 0x0940c5bcAAe6e9Fbd22e869c2a3cD7A21604ED8D — Not listed at all on GitHub.
- 0x5DCb2Cc68F4b975E1E2b77E723126a9f560F08E8 — Not listed at all on GitHub.
It is unclear why these changes are not reflected in the current version of the GitHub repository. Protoss reached out to WBTC for some clarification but did not receive a response prior to publication.
Looking further into the smart contract at 0x4dbbbFb0e68bE9D8F5a377A4654604a62E851e80, we can identify five addresses that have approved the HTX listing.
- 0xFDF28Bf25779ED4cA74e958d54653260af604C20 — Khyber
- 0xb0F42D187145911C2aD1755831aDeD125619bd27 — BitGo
- 0xddD5105b94A647eEa6776B5A63e37D81eAE3566F — Tom Bean
- 0x926314B7c2d36871eaf60Afa3D7E8ffc0f4F9A80 — BitGo
- 0x51c44979eA04256f678552BE65FAf67f808b3EC0 — BitGo
This means that this multi-signature wallet requires 5 signatures, but 3 of them are from the same entity.
Only two non-custodial entities have approved adding HTX as a seller, and they are not currently listed as DAO members on GitHub.
Adding to the intrigue is that Tom Bean’s project bZx was built on Kyber.
It is also worth highlighting the fact that this multi-signature wallet requires five signatures, BitGo controls three, and there are two addresses that are not listed on GitHub at all.
If these are managed by BitGo or BiT Global, it will be possible for the administrator to make changes without the approval of one additional WBTC DAO member.
Protos contacted WBTC to determine the identity of these two addresses, but again did not receive a response prior to publication.
BiT Global was added without WBTC DAO approval
This is not the first time that WBTC appears to be ignoring the touted role of the DAO.
WBTC’s white paper claimed that “addition/removal of custodians” will be controlled by this DAO.
This was also the case on the website, which claimed that “adding and removing merchants and custodians will be an open process governed by multi-signature agreements.”
Read more: Coinbase to delist WBTC months after Justin Sun controversy
Mike Belshe, CEO of BitGo, also claimed at the time BiT Global was in place that there was a large DAO that “owns the smart contracts” and “chooses how we manage this.”
Strangely, despite that claim, the WBTC DAO does not appear to have been consulted about adding Sun-affiliated BiT Global as a custodian of WBTC.
WBTC DAO’s Github does not yet list BiT Global as an administrator.
WBTC’s website lists BiT Global as one of its custodians, along with BitGo and BitGo Singapore.
The “member” smart contract still only lists a single custodian, 0xb0F42D187145911C2aD1755831aDeD125619bd27, the BitGo address.
This address is multi-signed, so BiT Global may have been added to this wallet as a signer. This means there was no need to update the smart contract with the new custodian address.
Broadly speaking, despite the fact that WBTC manages over $8 billion in value, it seems to ignore and ignore the DAO, which has often been a key part of its marketing.
The multi-signature wallet managing it was never updated and replaced by an unidentified member.
While this replacement made it possible or convenient to add HTX as a seller, it ignores other issues, such as the fact that both Alameda Research and Three Arrows Capital are included as sellers.
It appears that the large DAO was bypassed when it comes to adding BiT Global.
However, WBTC does not primarily operate through a DAO.
The country’s claims to transparency and decentralization have fallen short in the face of the difficulty of coordinating disparate actors around the world.
