Molly WhiteApr 9, 2023

The new team in charge of the FTX bankruptcy have released their first interim report on the failures of control at FTX and related businesses.

It's 43 pages long, let's go through it 🧵

https://www.courtlistener.com/docket/65748821/1242/1/ftx-trading-ltd/

#FTX #FTXcollapse

Exhibit A – #1242, Att. #1 in FTX Trading Ltd. (Bankr. D. Del., 22-11068) – CourtListener.com

Exhibit(s) (Notice of Filing First Interim Report of John J. Ray III to the Independent Directors on Control Failures at the FTX Exchanges) Filed by FTX Trading Ltd.. (Attachments: # 1 Exhibit A) (Pierce, Matthew) (Entered: 04/09/2023)

CourtListener
Show threadMolly WhiteApr 9, 2023
The debtors reiterate the stunning lack of recordkeeping and controls at FTX: "Normally, in a bankruptcy involving a business of the size and complexity of the FTX Group, particularly a business that handles customer and investor funds, there are readily identifiable records, data sources, and processes that can be used to identify and safeguard assets of the estate. Not so with the FTX Group."
Show threadMolly WhiteApr 9, 2023
"Upon assuming control, the Debtors found a pervasive lack of records and other evidence at the FTX Group of where or how fiat currency and digital assets could be found or accessed, and extensive commingling of assets."
Show threadMolly WhiteApr 9, 2023
FTX executives "stifled dissent, commingled and misused corporate and customer funds, lied to third parties about their business, [and] joked internally about their tendency to lose track of millions of dollars in assets"
Show threadMolly WhiteApr 9, 2023
Debtors are having to cobble together financial records from what they're able to find in QuickBooks and Slack records 💀
Show threadMolly WhiteApr 9, 2023
It sounds like the debtors are limited somewhat by the fact that laptops belonging to SBF and other high-level insiders are currently in the hands of the Bahamian Joint Provisional Liquidators, who've been less than cooperative (according to the US team, at least).
Show threadMolly WhiteApr 9, 2023
Nishad Singh, Gary Wang, and Caroline Ellison have all pled guilty and are cooperating with the DOJ, making it infeasible for the debtors to interview them for bankruptcy purposes until after the criminal trial is over. They have interviewed others, though.
Show threadMolly WhiteApr 9, 2023

"The FTX Group lacked independent or experienced finance, accounting, human resources, information security, or cybersecurity personnel or leadership, and lacked any internal audit function whatsoever. Board oversight, moreover, was also effectively non-existent."

“if Nishad [Singh] got hit by a bus, the whole company would be done. Same issue with Gary [Wang]."

Show threadMolly WhiteApr 9, 2023
Some new context on the sudden resignation of Brett Harrison in September 2022: he "resigned following a protracted disagreement", after which his bonus was drastically reduced.
Show threadMolly White
In a separate instance, a lawyer who was hired only three months prior, who learned about the North Dimension bank accounts, was "summarily terminated after expressing concerns about Alameda’s lack of corporate controls, capable leadership, and risk management."
Apr 9, 2023 at 11:16pmWeb
Show threadMolly WhiteApr 9, 2023
"At the time of the bankruptcy filing, the FTX Group did not even have current and complete lists of who its employees were."
Show threadMolly WhiteApr 9, 2023
"As a general matter, policies and procedures relating to accounting, financial reporting, treasury management, and risk management did not exist, were incomplete, or were highly generic and not appropriate for a firm handling substantial financial assets."
Show threadMolly WhiteApr 9, 2023
The small accounting firm used by FTX entities for most accounting "appears to have a small number of employees and no specialized knowledge relating to cryptocurrencies or international financial markets".
Show threadDarwinApr 9, 2023

@molly0xfff Thank you for this summary. It’s absolutely mind-blowing. I can’t help but feel a strange a sense of awe at the sheer nerve it takes to carry out that level of deception, irresponsibility, and complete disregard of one’s customers. Astonishing, really.

#FTX

Show threadRobin CapperApr 10, 2023
@darwinrz @molly0xfff And how they got away with it for so long
Show threadMermadeApr 10, 2023
@darwinrz @molly0xfff it's breathtaking and also unhinged. Why? Hubris and greed alone doesn't seem to cover this craziness. It's like they were in it for a ride they believed was going to end.
Show threadDarwinApr 10, 2023

@Mer @molly0xfff Exactly. They had to know it was going to end eventually…or did they? 🤷🏽‍♂️ And if they did…there was no other way for it to end other than horribly.

#FTX

Show threadMolly WhiteApr 9, 2023

More QuickBooks shade.

"Fifty-six entities within the FTX Group did not produce financial statements of any kind. Thirty-five FTX Group entities used QuickBooks as their accounting system and relied on a hodgepodge of Google documents, Slack communications, shared drives, and Excel spreadsheets and other non-enterprise solutions to manage their assets and liabilities"

Show threadMolly WhiteApr 9, 2023
"Approximately 80,000 transactions were simply left as unprocessed accounting entries in catch-all QuickBooks accounts titled 'Ask My Accountant.'"
Show threadMolly WhiteApr 9, 2023
Sam Bankman-Fried: "Alameda is unauditable... we are only able to ballpark what its balances are, let alone something like a comprehensive transaction history. We sometimes find $50m of assets lying around that we lost track of; such is life"
Show threadMolly WhiteApr 9, 2023
"Thousands of deposit checks were collected from the FTX Group’s offices, some stale-dated for months, due to the failure of personnel to deposit checks in the ordinary course; instead, deposit checks collected like junk mail."
Show threadMolly WhiteApr 9, 2023
Transfers in the tens of millions of dollars were approved via Slack emoji, or discussed in disappearing Signal or Telegram chats.
Show threadMolly WhiteApr 9, 2023
"Only four months after the real estate purchase had closed did the employee enter into a promissory note with Alameda in which he undertook to repay the funds used to purchase the property. Other insiders received purported loans from Alameda for which no promissory notes exist."
Show threadMolly WhiteApr 9, 2023
Accounts were opened using names and email addresses that were not obviously linked to FTX, using pseudonymous email addresses, in the names of shell companies created for these purposes, or in the names of individuals (including individuals with no direct connection FTX)
Show threadMolly WhiteApr 9, 2023
"Alameda also transferred funds to insiders to fund personal investments, political contributions, and other expenditures—some of which were nominally 'papered' as personal loans with below-market interest rates and a balloon payment due years in the future."
Show threadMolly WhiteApr 9, 2023
The document reiterates known allegations about Alameda's "unique ability to trade and withdraw virtually unlimited assets [on FTX], regardless of the size of its account balance and without risk of its positions being liquidated."
Show threadMolly WhiteApr 9, 2023
The FTX group had no cybersecurity staff whatsoever.
Show threadMolly WhiteApr 9, 2023
FTX stored private keys to its crypto wallets in AWS 🫠
Show threadMolly WhiteApr 9, 2023
"[FTX] kept virtually all crypto assets in hot wallets... [FTX] undoubtedly recognized how a prudent crypto exchange should operate, because when asked by third parties to describe the extent to which it used cold storage, it lied."
Show threadMolly WhiteApr 10, 2023
An employee wrote in internal communications that they had been "instructed that this information was not to be shared with regulators unless it was specifically requested. Another FTX Group employee responded that if the question was being posed by 'non-regulators,' then 'we say 10% in hot wallet, and 90% in cold wallet'"
Show threadMolly WhiteApr 10, 2023
FTX generally didn't use multisigs. When they did, they stored all of the keys together in one place, thus defeating the purpose.
Show threadMolly WhiteApr 10, 2023

Debtors give multiple examples of irresponsible key storage. Keys to >$100M stored in unencrypted plaintext, for example, or in tools unsuitable for the job. Keys were often accessible by many employees with no auditing. Keys were poorly labeled, with names like "use this".

swear to god my palms just started sweating reading that lol

Show threadMolly WhiteApr 10, 2023
"Passwords for encrypting the private keys of wallet nodes were stored in plain text, committed to the code repository (where they could be viewed by many and were vulnerable to compromise), and reused across different wallet nodes"
Show threadMolly WhiteApr 10, 2023
"Over a dozen people had direct or indirect access to the FTX.com and FTX.US central omnibus wallets, which held billions of dollars in crypto assets"
Show threadMolly WhiteApr 10, 2023
FTX didn't enforce use of multi-factor authentication for Google Workspace or 1Password, which the debtors note is ironic given tweets like this:
Show threadBenjamin JohnsApr 10, 2023
@molly0xfff Thinking about how I've never once thought about how many people at my bank have "access to the master password" to transfer all the bank's assets to a random account somewhere, because even if that wasn't on its face an absurd concept, if something like that DID happen, the bank would say "we fired that guy, undo" and the other bank who owned the other account would just, give it all back.
Show threadprozacchiwawaApr 10, 2023
@molly0xfff thinking on the poor security practices, ftx and execs would have been far better off losing a few billion via a platform exploit than being the only obvious cause of the collapse. almost a bit surprising nobody tried a fake compromise as a way out before the bankruptcy.
Show threadMolly WhiteApr 10, 2023
@prozacchiwawa that's still a distinct possibility
Show threadKofi Loves Efia Apr 10, 2023
@molly0xfff seems legit
Show threadColorblind CowboyApr 10, 2023
@molly0xfff Oh Jesus, really? Not even converted to pig Latin?
Show threadOfOtherWorldsApr 10, 2023
@molly0xfff When our bishop found out that my little parish church stored passwords in unencrypted plaintext, he was apoplectic.
Show threadRoy WigginsApr 10, 2023
@molly0xfff how in god's name did they make it as long as they did without some insider just pocketing the money and disappearing
Show threadFrank Millheim Apr 10, 2023
@roywig @molly0xfff *Sam Trabucco has entered the chat*
Show threadRoger MooreApr 10, 2023
@roywig @molly0xfff
My guess is they had problems with people pocketing money, but they didn't bother disappearing. The accounting system was tailor made to protect embezzlement, so the embezzlers weren't afraid of getting caught. Disappearing would just draw attention to the theft.
Show threadRoy WigginsApr 10, 2023
@VATVSLPR @molly0xfff probably true. What's a few million here or there?
Show threadSteve's PlaceApr 10, 2023

@molly0xfff I'm upset with myself for not better labeling 4 templates I emailed. Aghast at this! This is what a den of thieves would do to help their mates fill their coffers! Looks deliberate from the outset to my eyes. Gah!!!

The Land Without Regulation Enforcement is a horrible movie!!

Show threadVissApr 10, 2023
@molly0xfff this is spectacular asshattery
Show threadMarc JacobsApr 10, 2023
@molly0xfff Maybe they used extra special post-it notes to write them down, 😂
Show threadKyle RoseApr 10, 2023
@molly0xfff 😳
Show threadbassplayerApr 10, 2023
@molly0xfff oof poor opsec
Show threadmarcinkApr 10, 2023

@molly0xfff My brain just started adding "such is life" when reading all these quotes and excerpts.

Thanks for sharing these.

Show threadAnthonyApr 10, 2023
@molly0xfff
use this
use this 2
use this 2 for real
use this 2 for real final
Show threadSteve TorrenteApr 10, 2023
@molly0xfff "usethis_new_2"
Show threadRoger MooreApr 10, 2023
@molly0xfff
When I read this kind of thing, I tend to assume it's malice rather than incompetence. One of the main purposes of accounting is to catch insiders stealing from the company. A lack of accounting shows the thieves are in charge and don't want their theft discovered.
Show threadjmeleskyApr 10, 2023
@molly0xfff Why am I convinced that they still managed to lose them?
Show threadRoy WigginsApr 10, 2023
@molly0xfff sort of amazing it lasted long enough to be done in by fraud rather than an old-fashioned hack
Show threadOfOtherWorldsApr 10, 2023
@molly0xfff Nice to know that billionaires aren't better at security than a crazy dude on disability.
Show threadStephen FoskettApr 10, 2023
@molly0xfff FTX is lucky no one stole it all before the collapse! Thanks for sharing this!
Show threadPaul ChurchApr 10, 2023
@molly0xfff I particularly love that their security practices were to write some fan fiction about an exchange that used offline, air-gapped, encrypted, and geographically distributed laptops. I'm surprised they didn't go into more detail about the laser grid, automated sentry turrets, and cyber ninja assassins protecting the laptops.
Show threadRenéeApr 10, 2023

@molly0xfff Do they mean in AWS KMS HSM with full lifecycle management???

Do... do they...

They don't, do they

Show threadflere-imsaho 🇺🇦Apr 10, 2023
@reneestephen @molly0xfff my bet is s3 with public access.
Show threadvx. redgrave, maid of mindApr 10, 2023
@molly0xfff oh jeez, it's gonna be wild to find out how much money's just been blatantly stolen from them over it
Show threadAustin Dern, Dean of CoatisApr 10, 2023
@KitRedgrave @molly0xfff Always enjoy learning my little three-dozen-person fuzzball-based muck chugging along since 1998 has better cybersecurity and structural management than people with money do.
Show threadJiSeApr 10, 2023
@molly0xfff If someone would have breached them.. they probably would just have believed they were in a honeypot.
Show threadbassplayerApr 10, 2023
@molly0xfff stored them in the cloud how? A vault or some other way
Show threadMolly WhiteApr 10, 2023
@bassplayer https://hachyderm.io/@molly0xfff/110171624981915201
Molly White (@[email protected])

Attached: 2 images Debtors give multiple examples of irresponsible key storage. Keys to >$100M stored in unencrypted plaintext, for example, or in tools unsuitable for the job. Keys were often accessible by many employees with no auditing. Keys were poorly labeled, with names like "use this". swear to god my palms just started sweating reading that lol

Hachyderm.io
Show threadScott JampaApr 9, 2023
@molly0xfff
Show threadSarah T. Roberts, Ph.D.Apr 9, 2023
@molly0xfff lol. Big Skyler in Breaking Bad energy.
Show threaddark was the night 🌚Apr 10, 2023
@ubiquity75 Skyler actually did some accounting
Show threadFrank Bennett 🇯🇵Apr 10, 2023
@ubiquity75 @molly0xfff Skyler bore a emotional burden that seems utterly lacking here. We sometime misplace millions! LOL