A deep dive into FTX’s on-chain funds movement

FTX, despite its bankruptcy, is making substantial moves in its token portfolio, leading to speculations of imminent asset sales.

In the last few days, FTX, the bankrupt digital currency exchange founded by Sam Bankman-Fried, has undertaken a substantial rearrangement of its token portfolio.

The movements come after a U.S. bankruptcy court granted the exchange permission to sell, stake, and hedge a reported $3.4 billion in crypto assets in partnership with Galaxy Digital.

With all parties keen to expedite the process, it has commenced even as Bankman-Fried undergoes trial for charges, including fraud and money laundering, stemming from his role in the collapse of FTX.

Despite the serious accusations, Bankman-Fried maintains his innocence, and his legal defense team asserts there was no intent to misappropriate customer funds.

The rise and fall of FTX

Before its fall, FTX and Bankman-Fried played an outsized role in the crypto space. An MIT graduate, Bankman-Fried cut his teeth in arbitrage trading at Jane Street Capital before co-founding Alameda Research in 2017.

Two years later, in 2019, he established FTX, positioning it as a platform “built by traders, for traders.” The exchange initially specialized in crypto futures trading before later evolving to become the third-largest multi-asset trading platform by volume.

However, the exchange’s stability was shaken following the $60 billion TerraUSD and LUNA crash in May 2022.

The resignation of two key executives within a month, Alameda’s co-CEO Sam Trabucco and FTX’s President Brett Harrison, later that year, instigated a wave of curiosity and skepticism among FTX traders and members of the broader crypto community alike.

Soon after these departures, crypto publication CoinDesk revealed that Alameda’s net equity largely depended on a token created by its sister company, as well as several illiquid crypto assets such as Serum (SRM), Oxygen (OXY), and Bonfida (FIDA).

The company lacked stablecoins or major cryptos like Bitcoin (BTC) and Ether (ETH).

While crypto exchanges have traditionally launched proprietary tokens offering limited benefits such as discounted trading fees, FTX reportedly extensively used its native FTT token as collateral in various platforms, including Alameda.

The market maker’s CEO, Caroline Ellison, disputed CoinDesk’s claims, insisting the numbers revealed in the publication’s report did not fully reflect Alameda’s financial position, which she stated was over $14 billion.

Despite Ellison’s efforts, FTX and Alameda’s situation worsened when Binance revealed plans to sell off its FTT holdings, citing concerns over Alameda’s balance sheet.

Consequently, in a panic, other FTT holders started selling off their tokens, causing a liquidity crunch and a significant drop in FTT’s price.

On Nov. 6, 2022, on-chain data shared by CryptoQuant founder Ki Young Ju showed that FTX’s stablecoin reserve had taken a 93% hit in just a couple of weeks.

A day later, blockchain security firm Peckshield revealed that Alameda had transferred a large sum of stablecoins into FTX within a four-hour window.

Amid this tumultuous scenario, FTT’s value, which was trading at around $25, dropped below $5 by Nov. 8. The blow to the token’s price was just one part of a wider downturn in the crypto market, which saw over $100 billion disappear from the market cap in just 24 hours, with Bitcoin dropping to a two-year low, and Solana (SOL) losing 40% of its value due to its significant holdings by Bankman-Fried.

Per CryptoQuant, by Nov. 9, 2022, just 8.18% of FTX reserves were stablecoins, with ETH making up another 3.44%.

A similar analysis by on-chain detectives Lookonchain of 56 addresses belonging to Alameda indicated the market maker had a net worth of $222.4 million.

The analysis found that 19 of the 56 addresses had a net worth of more than $100,000, while 13 held more than $1 million worth of crypto each.

Despite intense speculation about Binance acquiring FTX, just a day after the rumors started, Binance announced they were stepping away from the deal.

On-chain investigators then found that FTX and Alameda Research transferred over $10 million in tokens to an address starting with “0xde9…”. Leading to reports of distressed sales and the company facing significant selling pressure.

FTX files for Chapter 11 bankruptcy protection

On Nov. 11, 2022, with no more cards to play, Sam Bankman-Fried resigned from his position as FTX CEO while simultaneously announcing the exchange had filed for bankruptcy protection in a U.S. court.

The application involved over 100 affiliated companies, including Alameda Research and FTX’s American subsidiary FTX.US.

Applying for Chapter 11 bankruptcy meant the company could get some leeway to reorganize its finances, restructure its debts, and continue operations.

After the filing, a balance sheet published by the Financial Times revealed that FTX was in the hole for more than $9 billion against a paltry $900 million in assets.

New CEO John J. Ray III claimed to have found an unprecedented absence of corporate controls and a complete lack of reliable financial information. He described the integrity of FTX’s systems as “compromised” and called its regulatory oversight “faulty.”

He had no kind words for the FTX leadership either, referring to them as “inexperienced, unsophisticated, and potentially compromised.”

U.S. authorities subsequently arrested Sam Bankman-Fried and charged him with embezzling billions of dollars of customer funds.

You might also like: FTX probes $6.5m payments to Center for AI Safety

On-chain movements of FTX funds

On Nov. 25, 2022, Arkham Intelligence published results of its on-chain analysis tracking outflows of funds from FTX.US days before the exchange’s collapse.

According to the analysis, Alameda received $204 million from FTX.US in eight different addresses. It then reportedly sent $142.4 million to wallets belonging to FTX International, suggesting it may have been used as a conduit between FTX.US and its global sibling.

Other movements included $152.15 million that was deposited to Binance, $38.06 million that was sent to the Bitcoin network, and $13.87 million kept in a trading wallet.

There have been more recent movements of FTX-related money stemming from the court, allowing the company to liquidate its crypto assets.

The company plans to cash in about $3.4 billion worth of digital assets in weekly tranches of $100 million to $200 million, with Galaxy Digital handling the limited public sales transactions.

In that regard, FTX and Alameda Research have made massive transfers involving various cryptocurrencies, with Lookonchain and blockchain analytics firm Spot On Chain providing a detailed breakdown of the assets, which include 787K SOL valued at $25.4M, 4,858 ETH worth $8.7M, and 532K Chainlink (LINK) going for $5.8M.

Additionally, eight addresses tied to FTX and Alameda, which recently sold assets, reportedly hold an impressive $619 million in cryptocurrencies. These consist of significant quantities of ETH, FTT, Worldcoin (WLD), and Polygon (MATIC).

On Oct. 16, as Mr. Bankman-Fried’s trial continued, addresses tied to FTX staked 5.5 million SOL tokens valued at $122 million and 24,000 ETH worth $30 million. On-chain analysts on X claimed the SOL may have been staked on Figment, where it’s expected to earn at least 6.79% annualized, which is roughly $8 million worth of SOL.

The ETH was staked directly on Ethereum, where it stands to earn about 3.4% annualized, translating to about $1 million in ETH.

In addition to the staked cryptocurrencies, reports show that FTX has recovered assets worth $7 billion, including more than $1 billion in SOL, $560 billion in BTC, and about $200 million worth of real estate in the Bahamas.

Since the initial staking, detailed blockchain data reveals that FTX-related crypto wallets have moved several batches of crypto, signaling the troubled exchange’s intention to make further sales.

Breaking down the movements

On Oct. 24, Spot On Chain reported that addresses belonging to the FTX and Alameda estates moved about $10.5 million worth of crypto to Coinbase and Binance.

A day later, they reported that the estates had moved a further 21,967 Compound (COMP) worth $1.01 million and 974,270 Render (RNDR) worth $2.04 million to the two exchanges. The total value of assets moved to approximately $13.35 million in just over 29 hours.

The information was corroborated by fellow on-chain detectives, Lookonchain, who added that an FTX cold storage wallet also transferred 469,578 SOL worth $15.2 million, of which 250,000 tokens were moved to Binance and Coinbase.

On Oct. 26, FTX and Alameda were at it again, moving another $6.5 million worth of crypto. This time, it comprised Uniswap (UNI), dYdX (DYDX), SushiSwap (SUSHI), and Lido (LDO) sent to two middle addresses with the expectation they would also land on exchanges post haste.

Additionally, Lookonchain stated that FTX-related crypto wallets deposited roughly $2.6 million in LINK and $1.3 million in Adventure Gold (AGLD) to Coinbase. $4.8 million in MATIC was also moved from an FTX wallet to an intermediary address, which further transferred $1.8 million of the tokens to Coinbase.

The following day, the two entities deposited $14.4 million worth of crypto to exchanges, bringing the total moved to exchanges so far to $47.3 million made up of 20 EVM assets. It left a reported $736 million in crypto still cooling in the FTX and Alameda-related wallets.

In the latest movement, Peckshield reported an FTX-labeled wallet had transferred out nearly 310,000 SOL tokens worth $9.9 million. Of the amount, approximately 244,000 tokens were sent to Binance.

In the crypto sphere, such large transfers to exchanges as have been undertaken by the FTX and Alameda addresses usually indicate that assets are about to be sold, potentially impacting the market.

The FTX hack

Apart from FTX’s positioning of its crypto assets for sale, the other FTX-related funds’ movement that caught the public’s attention recently was that made by an unknown individual who hacked the exchange and stole about $477 million worth of crypto amid the chaos ensuing from its collapse last year.

According to on-chain analytics firm Elliptic, the hacker first moved 9,500 ETH, then valued at approximately $15.5 million, from an FTX wallet to a new wallet. They then stole hundreds of other cryptocurrencies, including PAX Gold (PAXG), Tether (USDT), LINK, and MATIC, over several hours.

Of the stolen funds, Tether was able to freeze $31.5 million worth of USDT. It forced the hacker to change tact and swap the stolen assets for ETH, which, having no central issuer, could not be frozen.

The hacker then used cross-chain bridges to move the stolen funds from one blockchain to another. Per Elliptic, the thief moved funds they had stolen on Solana and Binance Smart Chain to their Ethereum account. They then combined it with others using Wormhole and Multichain.

The combined haul, now consisting of 245,000 ETH valued at $306 million, was kept dormant for five days until Nov. 20, when the hacker transferred 65,000 ETH to the Bitcoin network using RenBridge.

After converting the funds to BTC, the thief reportedly moved 2,849 coins through ChipMixer, with about $4 million worth suspected of ending up on exchanges where it was cashed out.

The hacker was then dormant for nine months until Sept. 30, 2023, just before Bankman-Fried’s trial began, when they once again converted 72,500 ETH into BTC, this time through THORSwap. The cross-chain bridge consequently suspended its services, forcing the thief to use the Sinbad crypto mixer to move their loot.

The hacker’s identity remains a mystery, although many speculate it could have been an inside job.

Read more: FTX in talks with investors to relaunch exchange