User deposits are being swept into the payout address. I had been watching my own deposit address for any movement, the first sweep was sent to the ops wallet that was funding the payout address. That sweep happened at the start of Feb. At some point after that they switched to sending the tokens directly to the payout wallet.
As for buybacks those will likely come from Kraken (address identified via Arkham Intel) based on the activity I observed for the 5% buyback’s they have been doing related to the planned staking feature. This is of course speculation on my part, but it is based on on-chain data.