A deep dive into FTX’s on-chain funds movement

FTX, despite its bankruptcy, is making substantial moves in its token portfolio, leading to speculations of imminent asset sales.

In the last few days, FTX, the bankrupt digital currency exchange founded by Sam Bankman-Fried, has undertaken a substantial rearrangement of its token portfolio.

The movements come after a U.S. bankruptcy court granted the exchange permission to sell, stake, and hedge a reported $3.4 billion in crypto assets in partnership with Galaxy Digital.

With all parties keen to expedite the process, it has commenced even as Bankman-Fried undergoes trial for charges, including fraud and money laundering, stemming from his role in the collapse of FTX.

Despite the serious accusations, Bankman-Fried maintains his innocence, and his legal defense team asserts there was no intent to misappropriate customer funds.

The rise and fall of FTX

Before its fall, FTX and Bankman-Fried played an outsized role in the crypto space. An MIT graduate, Bankman-Fried cut his teeth in arbitrage trading at Jane Street Capital before co-founding Alameda Research in 2017.

Two years later, in 2019, he established FTX, positioning it as a platform “built by traders, for traders.” The exchange initially specialized in crypto futures trading before later evolving to become the third-largest multi-asset trading platform by volume.

However, the exchange’s stability was shaken following the $60 billion TerraUSD and LUNA crash in May 2022.

The resignation of two key executives within a month, Alameda’s co-CEO Sam Trabucco and FTX’s President Brett Harrison, later that year, instigated a wave of curiosity and skepticism among FTX traders and members of the broader crypto community alike.

Soon after these departures, crypto publication CoinDesk revealed that Alameda’s net equity largely depended on a token created by its sister company, as well as several illiquid crypto assets such as Serum (SRM), Oxygen (OXY), and Bonfida (FIDA).

The company lacked stablecoins or major cryptos like Bitcoin (BTC) and Ether (ETH).

WOW

Per CoinDesk, Alameda research has $14.6 billion of assets, against $8b of liabilities.

For assets: $3.66b FTT, $2.16b “FTT collateral”, $3.37b crypto ($292m SOL, $863m “locked SOL”), $134m USD & $2b “equity securities.

Most net equity tied in completely illiquid altcoins.

— Dylan LeClair 🟠 (@DylanLeClair_) November 2, 2022

While crypto exchanges have traditionally launched proprietary tokens offering limited benefits such as discounted trading fees, FTX reportedly extensively used its native FTT token as collateral in various platforms, including Alameda.

The market maker’s CEO, Caroline Ellison, disputed CoinDesk’s claims, insisting the numbers revealed in the publication’s report did not fully reflect Alameda’s financial position, which she stated was over $14 billion.

A few notes on the balance sheet info that has been circulating recently:
– that specific balance sheet is for a subset of our corporate entities, we have > $10b of assets that aren’t reflected there

— Caroline (@carolinecapital) November 6, 2022

Despite Ellison’s efforts, FTX and Alameda’s situation worsened when Binance revealed plans to sell off its FTT holdings, citing concerns over Alameda’s balance sheet.

As part of Binance’s exit from FTX equity last year, Binance received roughly $2.1 billion USD equivalent in cash (BUSD and FTT). Due to recent revelations that have came to light, we have decided to liquidate any remaining FTT on our books. 1/4

— CZ 🔶 Binance (@cz_binance) November 6, 2022

Consequently, in a panic, other FTT holders started selling off their tokens, causing a liquidity crunch and a significant drop in FTT’s price.

On Nov. 6, 2022, on-chain data shared by CryptoQuant founder Ki Young Ju showed that FTX’s stablecoin reserve had taken a 93% hit in just a couple of weeks.

FTX’s stablecoin reserve just reached a year-low.

$51M as of now. -93% over the last two weeks.https://t.co/eG4SVOO6cV pic.twitter.com/GIj3nJGXf6

— Ki Young Ju (@ki_young_ju) November 6, 2022

A day later, blockchain security firm Peckshield revealed that Alameda had transferred a large sum of stablecoins into FTX within a four-hour window.

#PeckShieldAlert ~68.3M stablecoins ($BUSD, $USDT, $USDC) has been transferred from Alameda Research to @FTX_Official from several sources (Circle, Paxos) within the last 4 hours pic.twitter.com/KJFg6u6GsR

— PeckShieldAlert (@PeckShieldAlert) November 7, 2022

Amid this tumultuous scenario, FTT’s value, which was trading at around $25, dropped below $5 by Nov. 8. The blow to the token’s price was just one part of a wider downturn in the crypto market, which saw over $100 billion disappear from the market cap in just 24 hours, with Bitcoin dropping to a two-year low, and Solana (SOL) losing 40% of its value due to its significant holdings by Bankman-Fried.

Per CryptoQuant, by Nov. 9, 2022, just 8.18% of FTX reserves were stablecoins, with ETH making up another 3.44%.

(11.1) STABLECOIN RESERVE IN FTX
Per CryptoQuant on Nov 9th:
FTX has 8.18% (~$575M) of stablecoins in their reserve, with as little as 3.44% made up by ETH.https://t.co/v3SzsyFgry pic.twitter.com/OsqmSlqupC

— M3TA (@M3TA_Analytics) November 10, 2022

A similar analysis by on-chain detectives Lookonchain of 56 addresses belonging to Alameda indicated the market maker had a net worth of $222.4 million.

The analysis found that 19 of the 56 addresses had a net worth of more than $100,000, while 13 held more than $1 million worth of crypto each.

1/ How many assets does #Alameda have on-chain?

We analyzed 56 addresses starting with “0x” of #Alameda.

The net worth of Alameda is 222.4M USD.

And we also analyzed Alameda’s assets and Debts on Defi.👇#AlamedaResearch #FTTcrash #FTT #FTX pic.twitter.com/nonmvleXP8

— Lookonchain (@lookonchain) November 9, 2022

Despite intense speculation about Binance acquiring FTX, just a day after the rumors started, Binance announced they were stepping away from the deal.

As a result of corporate due diligence, as well as the latest news reports regarding mishandled customer funds and alleged US agency investigations, we have decided that we will not pursue the potential acquisition of https://t.co/FQ3MIG381f.

— Binance (@binance) November 9, 2022

On-chain investigators then found that FTX and Alameda Research transferred over $10 million in tokens to an address starting with “0xde9…”. Leading to reports of distressed sales and the company facing significant selling pressure.

FTX files for Chapter 11 bankruptcy protection

On Nov. 11, 2022, with no more cards to play, Sam Bankman-Fried resigned from his position as FTX CEO while simultaneously announcing the exchange had filed for bankruptcy protection in a U.S. court.

The application involved over 100 affiliated companies, including Alameda Research and FTX’s American subsidiary FTX.US.

Applying for Chapter 11 bankruptcy meant the company could get some leeway to reorganize its finances, restructure its debts, and continue operations.

After the filing, a balance sheet published by the Financial Times revealed that FTX was in the hole for more than $9 billion against a paltry $900 million in assets.

New CEO John J. Ray III claimed to have found an unprecedented absence of corporate controls and a complete lack of reliable financial information. He described the integrity of FTX’s systems as “compromised” and called its regulatory oversight “faulty.”

He had no kind words for the FTX leadership either, referring to them as “inexperienced, unsophisticated, and potentially compromised.”

U.S. authorities subsequently arrested Sam Bankman-Fried and charged him with embezzling billions of dollars of customer funds.

You might also like: FTX probes $6.5m payments to Center for AI Safety

On-chain movements of FTX funds

On Nov. 25, 2022, Arkham Intelligence published results of its on-chain analysis tracking outflows of funds from FTX.US days before the exchange’s collapse.

Arkham analysed flows from FTX US in the final few days before the collapse, finding that Alameda withdrew the most funds, at $204M.

Below is a diagram of withdrawals to Arkham-identified entities from FTX US.

n.b. this thread regards FTX US assets only, not FTX International. pic.twitter.com/QFPVlVIWhO

— Arkham (@ArkhamIntel) November 25, 2022

According to the analysis, Alameda received $204 million from FTX.US in eight different addresses. It then reportedly sent $142.4 million to wallets belonging to FTX International, suggesting it may have been used as a conduit between FTX.US and its global sibling.

Other movements included $152.15 million that was deposited to Binance, $38.06 million that was sent to the Bitcoin network, and $13.87 million kept in a trading wallet.

There have been more recent movements of FTX-related money stemming from the court, allowing the company to liquidate its crypto assets.

The company plans to cash in about $3.4 billion worth of digital assets in weekly tranches of $100 million to $200 million, with Galaxy Digital handling the limited public sales transactions.

In that regard, FTX and Alameda Research have made massive transfers involving various cryptocurrencies, with Lookonchain and blockchain analytics firm Spot On Chain providing a detailed breakdown of the assets, which include 787K SOL valued at $25.4M, 4,858 ETH worth $8.7M, and 532K Chainlink (LINK) going for $5.8M.

Additionally, eight addresses tied to FTX and Alameda, which recently sold assets, reportedly hold an impressive $619 million in cryptocurrencies. These consist of significant quantities of ETH, FTT, Worldcoin (WLD), and Polygon (MATIC).

On Oct. 16, as Mr. Bankman-Fried’s trial continued, addresses tied to FTX staked 5.5 million SOL tokens valued at $122 million and 24,000 ETH worth $30 million. On-chain analysts on X claimed the SOL may have been staked on Figment, where it’s expected to earn at least 6.79% annualized, which is roughly $8 million worth of SOL.

The ETH was staked directly on Ethereum, where it stands to earn about 3.4% annualized, translating to about $1 million in ETH.

In addition to the staked cryptocurrencies, reports show that FTX has recovered assets worth $7 billion, including more than $1 billion in SOL, $560 billion in BTC, and about $200 million worth of real estate in the Bahamas.

Since the initial staking, detailed blockchain data reveals that FTX-related crypto wallets have moved several batches of crypto, signaling the troubled exchange’s intention to make further sales.

Breaking down the movements

On Oct. 24, Spot On Chain reported that addresses belonging to the FTX and Alameda estates moved about $10.5 million worth of crypto to Coinbase and Binance.

🚨 #FTX and #Alameda related addresses are depositing tokens to exchanges!

Via address 0xde9, #FTX 0x97f and #Alameda 0xf02 have transferred

2,904 $ETH ($5.21M)
1,341 $MKR ($2.01M)
11,975 $AAVE ($1.02M)
198,807 $LINK ($2.27M)

to #Binance and #Coinbase in the past 5 hours.… pic.twitter.com/MQxCySp8g0

— Spot On Chain (@spotonchain) October 25, 2023

A day later, they reported that the estates had moved a further 21,967 Compound (COMP) worth $1.01 million and 974,270 Render (RNDR) worth $2.04 million to the two exchanges. The total value of assets moved to approximately $13.35 million in just over 29 hours.

🚨🚨 FTX and Alameda addresses further transferred 21,967 $COMP ($1.01M) and 974,270 $RNDR ($2.04M) to #Binance via #Wintermute ~4hrs ago.

Overall, a total of $13.35M worth of 6 assets have been deposited to #Binance and #Coinbase over the past 29 hours.

👉 Address:… https://t.co/9WWf6ae81M pic.twitter.com/ez4m5I3RnK

— Spot On Chain (@spotonchain) October 26, 2023

The information was corroborated by fellow on-chain detectives, Lookonchain, who added that an FTX cold storage wallet also transferred 469,578 SOL worth $15.2 million, of which 250,000 tokens were moved to Binance and Coinbase.

FTX Cold Storage #2 transferred $469,587 $SOL ($15.2M) out 7 hours ago, of which 250K $SOL($8.1M) was transferred to exchanges.

170K $SOL($5.5M) was transferred to #Binance, and 80K $SOL ($2.6M) was transferred to #Coinbase.https://t.co/q0qjhcpPGchttps://t.co/cxJnFSLmvT pic.twitter.com/fdA65dnQZE

— Lookonchain (@lookonchain) October 26, 2023

On Oct. 26, FTX and Alameda were at it again, moving another $6.5 million worth of crypto. This time, it comprised Uniswap (UNI), dYdX (DYDX), SushiSwap (SUSHI), and Lido (LDO) sent to two middle addresses with the expectation they would also land on exchanges post haste.

🚨🚨 FTX and Alameda further transferred $6.5M worth of $UNI, $DYDX, $SUSHI and $LDO to 2 middle addresses to later deposit to exchanges soon!

👉 Addresses:https://t.co/3B5LcAigdFhttps://t.co/gfG3kkjIjm https://t.co/YRcXkU3LtT pic.twitter.com/lK5RlOLJvS

— Spot On Chain (@spotonchain) October 27, 2023

Additionally, Lookonchain stated that FTX-related crypto wallets deposited roughly $2.6 million in LINK and $1.3 million in Adventure Gold (AGLD) to Coinbase. $4.8 million in MATIC was also moved from an FTX wallet to an intermediary address, which further transferred $1.8 million of the tokens to Coinbase.

UPDATE:
FTX/Alameda sold 253,862 $LINK($2.67M) and 1.59M $AGLD($1.34M) ~30 minutes ago.https://t.co/zrYDn41Ja8 pic.twitter.com/YDGCvs8Z0w

— Lookonchain (@lookonchain) October 26, 2023

The following day, the two entities deposited $14.4 million worth of crypto to exchanges, bringing the total moved to exchanges so far to $47.3 million made up of 20 EVM assets. It left a reported $736 million in crypto still cooling in the FTX and Alameda-related wallets.

🚨🚨 [UPDATED] #FTX and #Alameda Research deposited $14.4M worth of 8 tokens $MATIC, $BAND, $PERP, $TRU, $BICO, $KNC, $CVC and $BOND to exchanges ~2hrs ago.

Top 3 include:

8.15M $MATIC ($4.96M)
2.03M $BAND ($3.15M)
3.76M $PERP ($2.28M)

Overall, FTX and Alameda have deposited… https://t.co/h1tMmi0k64 pic.twitter.com/XUOZFtVdh6

— Spot On Chain (@spotonchain) October 28, 2023

In the latest movement, Peckshield reported an FTX-labeled wallet had transferred out nearly 310,000 SOL tokens worth $9.9 million. Of the amount, approximately 244,000 tokens were sent to Binance.

#PeckShieldAlert FTX-labeled address transferred ~309.2K $SOL (~$9.9M) out. Part of them (~244K $SOL) has been sent to #Binance pic.twitter.com/KpgfyCMCRd

— PeckShieldAlert (@PeckShieldAlert) October 28, 2023

In the crypto sphere, such large transfers to exchanges as have been undertaken by the FTX and Alameda addresses usually indicate that assets are about to be sold, potentially impacting the market.

The FTX hack

Apart from FTX’s positioning of its crypto assets for sale, the other FTX-related funds’ movement that caught the public’s attention recently was that made by an unknown individual who hacked the exchange and stole about $477 million worth of crypto amid the chaos ensuing from its collapse last year.

According to on-chain analytics firm Elliptic, the hacker first moved 9,500 ETH, then valued at approximately $15.5 million, from an FTX wallet to a new wallet. They then stole hundreds of other cryptocurrencies, including PAX Gold (PAXG), Tether (USDT), LINK, and MATIC, over several hours.

Of the stolen funds, Tether was able to freeze $31.5 million worth of USDT. It forced the hacker to change tact and swap the stolen assets for ETH, which, having no central issuer, could not be frozen.

The hacker then used cross-chain bridges to move the stolen funds from one blockchain to another. Per Elliptic, the thief moved funds they had stolen on Solana and Binance Smart Chain to their Ethereum account. They then combined it with others using Wormhole and Multichain.

The combined haul, now consisting of 245,000 ETH valued at $306 million, was kept dormant for five days until Nov. 20, when the hacker transferred 65,000 ETH to the Bitcoin network using RenBridge.

After converting the funds to BTC, the thief reportedly moved 2,849 coins through ChipMixer, with about $4 million worth suspected of ending up on exchanges where it was cashed out.

The hacker was then dormant for nine months until Sept. 30, 2023, just before Bankman-Fried’s trial began, when they once again converted 72,500 ETH into BTC, this time through THORSwap. The cross-chain bridge consequently suspended its services, forcing the thief to use the Sinbad crypto mixer to move their loot.

The hacker’s identity remains a mystery, although many speculate it could have been an inside job.

Read more: FTX in talks with investors to relaunch exchange

Source