If OP had bothered to do any decent research he would know that those two addresses are the BAT new user pool (i.e. free tokens for new users) and the developer pool. They were created before the token sale. Their existence is highlighted in the T&Cs of the BAT ICO sale. There is nothing nefarious about them. It is 100% transparent. I don't know how OP could have overlooked this so I suspect he is trying to have you believe a false narrative for his own purpose.