Forensic investigator: Sudden shut down of the COSS exchange looks suspicious

A blockchain forensics investigator thinks that COSS’s surprise decision to shut down its crypto exchange two weeks ago bears the hallmarks of a possible exit scam. 

COSS, a three-year-old exchange based in Singapore, denies any allegation of wrongdoing. It shuttered the exchange without warning—locking up some $2 million of customer money—and continues to maintain that the site needs to be offline for a much-needed upgrade, which could take up to a month. 

Strange doings

“There is precisely zero reason to take an exchange down for 3-4 weeks for a platform upgrade,” Rich Sanders, an investigator at the London-based blockchain forensics and investigation firm, Cipherblade, told Decrypt. 

Sanders released images on Twitter showing COSS had swept some of its Bitcoin funds to Binance around the time of the shutdown. Sending funds to anonymous Binance wallets is suspect, said Sanders, who investigates ICOs for a living. 

Sanders said the move could be a way of hiding customer funds before telling the community that the funds have, say, gone missing. “It'd be the ‘perfect crime’ to relaunch COSS with negligible amounts of new features,” he said.

COSS community manager Satyarth Mishra, the public voice of COSS, disputed Sanders’ conclusions, and said that no funds had been transferred to Binance. “You can pull up a few wallet addresses on any blockchain explorer and claim anyone you like is making those transactions,” he wrote on Telegram. 

But Sanders countered: “That is not the behavior of a user withdrawal to Binance, but of an individual that owns exchange wallets sweeping funds, instead of to a hot wallet, to Binance.” 

COSS has disclosed wallets for Ether holdings, and Mishra said that other funds were placed into a cold wallet, whose address “remains undisclosed.”

How to put out the FUD

COSS could straighten things out by disclosing the addresses of the wallets that hold customer funds, the names of the investors and the auditors looking into the matter, as well as further technical details about the migration to an upgraded system. But, despite customer outrage, it said it will wait until the exchange reopens.

On Tuesday, COSS founder Rune Evensen gave this statement to Decrypt: “There are ongoing daily meetings between the involved parties and they will make a formal announcement once they are ready. No comment until then.” 

Indeed, COSS has declined to answer further questions on the record from Decrypt. 

Meanwhile, volunteer administrators in COSS’s Telegram group, whose actions are roughly coordinated by COSS, ban users they claim are spreading “FUD.” Questions such as “Is the exchange solvent?” “Have the funds been sent to Binance?” and “Where is the Bitcoin held?” appear to be automatically banned. Attempts from multiple accounts to post those questions were blocked.