Exposing Fraud at FTX

The month of November of 2022 was one of the craziest months of my life.

It all started on November 2nd, when Coindesk published an article on a leaked snapshot of Alameda Research’s balance sheet. Alameda was allegedly holding billions of dollars worth of FTX’s FTT token. That was extremely concerning given that it essentially operated as FTX’s prop trading firm.

Four days later, on November 6th, CZ tweeted that “due to recent revelations that have came [sic] to light,” Binance would be liquidating the rest of the FTT they had on their books. FTT started selling off and concerns began mounting that it would start impacting FTX.

I grew increasingly suspicious not only of FTX and Alameda, but also of Binance. After all, Binance received roughly $2.1 billion of FTT as part of an investment exit in 2021. Had they already cashed out? I spent the following 2 days trying to find out, sleeplessly analyzing the FTT ERC20 ledger. Using ATLAS, a tool we developed in 2020, I parsed through nearly 300k FTT transactions, focusing on large tranfers in USD terms.

On November 8th, I found something. Fourty-one days earlier, on September 28th, over 8.6 Billion USD worth of FTT was moved on-chain. This represented the most significant single-day movement of FTT to date, and one of the largest daily transfers of any ERC20 token ever recorded by Coin Metrics. Simply looking at on-chain volume was critical here as it enabled me to narrow the search field from nearly 300k transactions to the 230 transactions that happened on Sept. 28.

The first transaction that looked suspicious that day was a large transfer of over $4B USD worth of FTT tokens. Upon examining the smart contract that sent this transaction, I realized this was an automated transfer of FTT from the project’s ICO from back in 2019. The recipient? No one but Alameda Research. These tokens were promised to Alameda in 2019 as part of their contributions to FTX in its early history but were only sent to the former in September as per a vesting schedule.

What happened next was mind-boggling. Alameda almost immediately sent the $4B USD worth of FTT to the FTT token deployer contract, who is basically the creator of the token. This is highly unusual since deployer contracts are not typically used to receive large transfers. The FTT deployer contract is FTX itself, considering FTX launched and managed the FTT token.

This September 28th transaction may have been a roundabout way for Alameda to repay FTX for a large loan. My theory was that Alameda may have blown up in May or June 2022, along with LUNA, 3AC collapse, amongst others. In order to stay afloat, FTX could have provided Alameda with a loan at the time to cover the losses.

On November 10th, Reuters published an interview with former FTX executives where a transfer of the same size was mentioned. In my view, what the whistleblowers shared with Reuters lends credence to my theory:

Seeking to prop up Alameda, which held almost $15 billion in assets, Bankman-Fried transferred at least $4 billion in FTX funds, secured by assets including FTT and shares in trading platform Robinhood Markets Inc, the people said. Alameda had disclosed a 7.6% share in Robinhood that May.

My twitter thread sharing the findings went unexpectedly viral, reaching 4 million views and leading my DMs to be flooded with messages from users, former employees, and other analysts sharing additional insights and data.

My team at Coin Metrics had a mission: we wanted to determine the extent of contagion using both onchain and offchain data. Myself, Kyle Waters, Matías Andrade, Christine Lee, and Christian Brazell, collaborated over the following weeks in what I considered to be the most thorough analysis of the collapse of FTX.

We began by shifting our focus to Binance’s FTT-USDT market. After all, FTT was central to both FTX and Alameda’s survival. Prior to the collapse, FTT was a top-performing asset in the bear market and a welcomed form of collateral among FTX counterparties. It was imperative for the price of FTT to retain a certain valuation and therefore support FTX’s solvency. Our initial goal was to see when exactly the FTT sell-off began and whether Alameda attempted to inject liquidity into that market.

Upon analyzing the orderbook of FTT-USDT, it bacame clear that a large player had repeatedly attempted to provide price support to FTT. In fact, shortly after CoinDesk published their initial article on Alameda’s balance sheet, a clear price support was formed of $23.50 per FTT. Two days later, on November 5th, a swath of sell orders shifted the price trend as Binance began selling its own FTT position. That was a day before CZ publicly announced the unwind of their FTT position.

Alameda continued to try and provide support to FTT, with Alameda’s CEO offering to buy Binance’s position at a premium. None of these efforts worked out and, by November 7th, sell order volume had increased 6x. Prices collapsed and Alameda, who was very likely the one trying to prop them up, gave up. This analysis of the order book led us to two critical insights. First, Alameda was likely the entity continuously attempting to prop up FTT, potentially using millions of dollars of siphoned FTX user funds in the process. Second, the collapse of FTT was trigged in Binance’s FTT-USDT market, potentially by Binance itself.

We then shifted our focus back to the on-chain side. We wanted to establish the inflows and outflows of funds into and out of Alameda’s wallets. Our starting point was a list of addresses thought to belong to Alameda with varying degrees of confidence. Some of the addresses were deterministic, such as the FTT ICO address from 2019 which featured a vesting schedule. Others were probabilistic and were collected by entities that interacted with Alameda over the years.

Assessing the inflows and outflows associated with a cluster of addresses can shed light on what counterparties, tokens, venues, and protocols an entity has interacted with, as well as the nature of these interactions. In the case of Alameda, there was an enormous amount of activity to analyze comprising dozens of billions of dollars in token inflows and outflows. To complicate things even further, these addresses also engaged in a lot of cross-chain transactions to networks like Avalanche, Fantom, Polygon and Solana.

Source: Coin Metrics, Etherscan

The biggest outflow ‘type’ from Alameda was directed towards DeFi lending protocols, amounting to $7.8 billion. This was closely followed by a $4.6 billion outflow to DeFi LP and farming protocols and a $4.4 billion outflow to non-FTX exchanges.

Stablecoin outflows were also staggering, tallying up to $27 billion. This includes two previously-untagged Alameda and FTX addresses. The size of this outflow is indicative of high leverage, suggesting that all available forms of debt, both on-chain and off-chain, were utilized. Some of this debt was possibly collateralized with illiquid cryptoassets such, as FTT, whose value notably decreased throughout the first half of 2022, with the loan denominated in stablecoins.

Another interesting insight was that, especially in the months leading up to FTX’s collapse, the exchange received funds from Alameda. This lends credence to the theory that FTX was grappling with significant liquidity challenges and was in need of financial support from Alameda until its demise.

The fallout from all of this ensured I got very little sleep in November. Following FTX, I also did an exposé on Serum, which may have fraudulently minted 60% of its supply to rug-pull its users.

Our research on this area was featured in the Wall Street Journal, Forbes, and many other publications.

In spite of the circumstances, it was an absolute pleasure working alongside Kyle Waters, Matías Andrade, Christine Lee, Christian Brazell, and many others from the Coin Metrics team on this analysis.

Make sure to check out the original publications: State-of-the-Network #181, and State-of-the-Network #182.