X-explore

Posted on Nov 08, 2022Read on Mirror.xyz

The Truth behind the Bank Run on FTX

This article is jointly published by X-explore and WuBlockchain.

1. Overview

Recently, the blur on trading Alameda’s balance sheet have caused heated discussions in cryptocurrency. On the 6th, CZ announced on Twitter that it would liquidate the remaining FTT assets, which led to the gradual spread and enlargement of the FTX trust crisis and a large-scale withdrawal and run. X-explore reveal the truth behind this event through on-chain data:

  1. From November 6th to November 7th, there was a serious bank run on FTX, with a cumulative withdrawal of more than 4.4 billion USD, including top market makers (Wintermute, Amber, Genisis Trading). This has led to a serious shortage of hot wallet positions in FTX mainstream currencies.

  2. FTX does not have a cold wallet, and FTX continues to withdraw a large amount of loan funds that Almanda Research uses for market making in major exchanges. At the same time, it also withdraw loan funds from other lenders, such as BlockFi, to quickly replenish the position balance of the hot wallet.

  3. As of 10:00 UTC on November 8th, the balance of various tokens in the FTX hot wallet is about 600 million, and the balance of Almanda Research's market-making funds in major exchanges is estimated to be 3.6 billion. According Bitdao to the sudden price drop and on-chain analysis, Almanda Research is selling some non-stable currency tokens to meet users' demand for withdrawals. But if large-scale withdrawals continue to occur, FTX hot wallet liquidity will be very seriously challenged.

2. Bank Run on FTX

We analyze the withdrawals of mainstream tokens on the mainstream chain during the two days from November 6, 2022 to November 7, 2022 in FTX. Due to the absence of on-chain address labels, our analysis results are only approximations. We have these conclusions:

  1. The cumulative withdrawal amount of BTC, XRP, ETH, USDC, USDT in two days exceeds 4.4 billion USD.

  2. Top market makers (Wintermute, Amber, Genisis Trading) are among the bank run users, accounting for more than 10% of the total.

  3. The run has resulted in a serious shortage of FTX mainstream currency hot wallet positions. As of 10:00 UTC on November 8, the hot wallet balance was less than 10% compared to November 5, and it was also less than 10% compared to the amount of gold issued in the last two days.

Coin1: ETH

A total of 30,548 withdrawals were made, involving an amount of 737,022 ETH (about 1,172,547,000 USD). The top withdrawal users are:

  1. Genesis Trading.com (0xBe385B59931C7fC144420F6c707027D4c2d37a81) withdrew 23,844 ETH. Genesis Trading is located in New York, providing trading, lending and hedging platforms for institutional investors.

  2. CoinHako.com (0x1d1bD550197c7c0787b9ad0aEA9c1CCa66eE0E90) withdraws 25,765 ETH. Coinhako is a centralized exchange that provides services to users in Singapore.

  3. Gemini (0x50e0c1b8eafA9Bf4Fe5Ec6Aca405f0fEE7Ff05b5) withdrew 30,900 ETH. Gemini is a centralized exchange located in New York.

As of November 8th at 10:00 UTC, the hot wallet ETH balance is 34,328 ETH. It only accounted for 4.6% of the total amount of deposits in the past 2 days, and it accounted for 9% of the wallet balance on November 5. The corresponding FTX address is:

0xC098B2a3Aa256D2140208C3de6543aAEf5cd3A94

0x2FAF487A4414Fe77e2327F0bf4AE2a264a776AD2

0xf1556137E7f45817e774096c5922f32c68AB15aE

0x25eaff5b179f209cf186b1cdcbfa463a69df4c45

0x7abe0ce388281d2acf297cb089caef3819b13448

Coin2: USDC

A total of 14,821 withdrawals were made, involving an amount of 1,409,272,000 USDC. The top withdrawal users are:

  1. Amber (0x1Bf01298bd4c47174e7E59A2f9F720753104f309) withdraws 80,000,000 USDC. Amber is a New York-based platform that provides crypto financial services to institutions.

As of 10:00 UTC on November 8, the hot wallet USDC balance was 4,715,346 USDC. It only accounted for 0.3% of the total amount of deposits in the past 2 days, and accounted for 6.4% of the wallet balance on November 5. The corresponding statistical address is the same as ETH.

Coin3: USDT(ETH)

A total of 10,302 withdrawals were made, involving an amount of 567,045,000 USDT. The top withdrawal users are:

  1. Genesistrading.com (0xBe385B59931C7fC144420F6c707027D4c2d37a81) withdraw 69,356,000 USDT

As of now, the hot wallet USDT (ETH) balance is 22,013,129 USDT. It only accounted for 3.8% of the total amount of deposits in the past 2 days, and it accounted for 11% of the wallet balance on November 5. The corresponding statistical address is the same as ETH.

Coin4: USDT(TRX)

A total of 34,729 withdrawals were made, involving an amount of 619,633,000 USDT. The top withdrawal users are:

  1. Wintermute (TNvxy1cstZwzobWEJDKAXPYw1DZ11nCW7t) withdraws 5,428,848 USDT. Wintermute is a London-based crypto market maker specializing in high-frequency algorithmic trading and market-making services.

As of 10:00 UTC on November 8, the hot wallet USDT (TRX) balance was 24,740,614 USDT. It only accounts for 3.9% of the total daily deposits in the past 2 days. The corresponding FTX address is: TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t

Coin5: BTC

A total of 699 withdrawals were made, involving an amount of 4,523BTC (about 94,520,000 USD). The top withdrawal users are:

  1. The address of Gemini exchange (1KjZBQ93a168QcrrPTSSNXqCH2PSMwMRFH) withdraw 730BTC

Coin6: XRP

A total of 7,560 withdrawals were made, involving an amount of 222,350,000 XRP (about 105,524,000 USD). The top withdrawal users are:

  1. CoinHako.com (rDCWkSuwrXPffeX2YgSuV7uRgDfUwi9PVi) withdraws 15,001,723XRP.

As of November 8th at 10:00 UTC, the hot wallet XRP balance was 35,230,000 XRP. It only accounts for 15% of the total daily deposit in the past 2 days. The corresponding FTX address is: rPFXvVo2fYXVPdV9gCHQouHsMgMhQ2aUwM

3. Sources of FTX funding in Bank Run

Usually, exchanges store user funds in cold wallets, and when a run occurs, funds in cold wallets can be transferred to hot wallets and withdrawn to users. However, FTX's cold wallet address was not found in our analysis, because FTX has a quantitative trading team Almanda, FTX lends the funds deposited by users to the exchange to Almanda, and Almanda makes markets in different exchanges and earns huge profits. Because the amount of ETH withdrawal is huge. Therefore, we analyze the source of funds of the ETH hot wallet in the past two days.

3.1 Withdrawal of borrowed funds from Almanda Research:

To get the funds made by Almanda Research in various exchanges back to the FTX wallet, we analyze that there are two ways to get back:

  1. The Almanda address directly deposits FTX. Based on the Almanda address provided by Larry Cermak, we analyzed that only 315ETH returned to FTX on November 7th.

  2. The funds made by Almanda in the exchange market are directly withdrawn to FTX. We analyze the top deposits one by one.

    Binance Linked Address 0xf4E7D9DC273Fb9641Bbd0223f20a54BB804d8746: 19,378ETH 
0x0e71DEdAdBC2A2a3fe7bfa2aE733Dae1540bD1B4: 28,685 ETH

Binance US Linked Address 0xf4E7D9DC273Fb9641Bbd0223f20a54BB804d8746: 2,217 ETH

Kraken Associated Address 0xB84Cd93582Cf94B0625C740F7EA441E33bC6FD6F: 6,000 ETH 0xa78b30fBCDfCee068a1e47bC17341F78886e88bb: 2,300 ETH

LMAX Digital Associated Address: 0xb66d2768274420F72B803829a1dAc51c320c6499: 7,000ETH

Bybit associated address: 0xa78b30fBCDfCee068a1e47bC17341F78886e88bb: 2,500ETH

MEXC associated address: 0xa78b30fBCDfCee068a1e47bC17341F78886e88bb: 903ETH

Huobi associated address: 0xa78b30fBCDfCee068a1e47bC17341F78886e88bb: 500ETH

Gateio associated address: 0xa78b30fBCDfCee068a1e47bC17341F78886e88bb: 623ETH
123

3.2 Withdrawal of borrowed funds from Other Entity:

While analyzing Almanda Research lending funds, we found that FTX has also invested in other lending projects. Such as BlockFi.

Deposit address: 0xf1556137E7f45817e774096c5922f32c68AB15aE: 6536 ETH

In July of this year, the US cryptocurrency platform BlockFi was affected by the bankruptcy of Three Arrows Capital, and there was a liquidity crisis. The cryptocurrency exchange FTX assisted a $400 million revolving credit loan, including an additional $240 million acquisition option. This seems to herald the crisis of FTX, which may accelerate the bankruptcy of BlockFi.

3.3 Fund transfer from affiliated exchanges

Both FTX US and Blockfilio are centralized exchanges in the FTX ecosystem. We found that large amounts of funds were transferred from FTX US and Blockfilio hot wallets, respectively.

3.4 Sell various Token assets

At present, the total asset balance on the FTX hot wallet address is 622 million. Based on the 31 Almanda Research addresses disclosed by Larry Cermak, a total of 15 billion was obtained from the FTX hot wallet, and 6 billion was sent to the FTX hot wallet, of which 40% were transferred to major exchanges. It can be roughly predicted that Almanda Research has 3.6 billion used in various exchange , but according to the price dive of Bitdao and the tweet from the CEO of Bybit asking Almanda Research to give an address within 24 hours to prove that it has 100 million Bitdao, it can be seen that Almanda Research is selling some non-stable currency tokens to Satisfy the user's withdrawal needs.

In addition, Almanda Research's deposit address in Binance is 0x3507e4978e0eb83315d20df86ca0b976c0e40ccb, which has recently received a large number of sub-mainstream tokens, such as BNB, LDO, and SUSHI, which are also suspected of selling non-stable currency tokens.

ARWEAVE TX →

MMWnY2RjHZ_CfmD1Ku3zYKi0UYw0SLHV2QTnCU0B0us

ETHEREUM ADDRESS →

0x302a3b1Eea855A56A28Fa59120c767C0CA21115b

CONTENT DIGEST

ishIhn4oONGig1tyIK0MvOo_ynSDDOvSC4TCfzUG8n4

Recommended Reading