Molly WhiteApr 9, 2023

The new team in charge of the FTX bankruptcy have released their first interim report on the failures of control at FTX and related businesses.

It's 43 pages long, let's go through it 🧵

https://www.courtlistener.com/docket/65748821/1242/1/ftx-trading-ltd/

#FTX #FTXcollapse

Exhibit A – #1242, Att. #1 in FTX Trading Ltd. (Bankr. D. Del., 22-11068) – CourtListener.com

Exhibit(s) (Notice of Filing First Interim Report of John J. Ray III to the Independent Directors on Control Failures at the FTX Exchanges) Filed by FTX Trading Ltd.. (Attachments: # 1 Exhibit A) (Pierce, Matthew) (Entered: 04/09/2023)

CourtListener
Show threadMolly WhiteApr 9, 2023
The debtors reiterate the stunning lack of recordkeeping and controls at FTX: "Normally, in a bankruptcy involving a business of the size and complexity of the FTX Group, particularly a business that handles customer and investor funds, there are readily identifiable records, data sources, and processes that can be used to identify and safeguard assets of the estate. Not so with the FTX Group."
Show threadMolly WhiteApr 9, 2023
"Upon assuming control, the Debtors found a pervasive lack of records and other evidence at the FTX Group of where or how fiat currency and digital assets could be found or accessed, and extensive commingling of assets."
Show threadMolly WhiteApr 9, 2023
FTX executives "stifled dissent, commingled and misused corporate and customer funds, lied to third parties about their business, [and] joked internally about their tendency to lose track of millions of dollars in assets"
Show threadMolly WhiteApr 9, 2023
Debtors are having to cobble together financial records from what they're able to find in QuickBooks and Slack records 💀
Show threadMolly WhiteApr 9, 2023
It sounds like the debtors are limited somewhat by the fact that laptops belonging to SBF and other high-level insiders are currently in the hands of the Bahamian Joint Provisional Liquidators, who've been less than cooperative (according to the US team, at least).
Show threadMolly WhiteApr 9, 2023
Nishad Singh, Gary Wang, and Caroline Ellison have all pled guilty and are cooperating with the DOJ, making it infeasible for the debtors to interview them for bankruptcy purposes until after the criminal trial is over. They have interviewed others, though.
Show threadMolly WhiteApr 9, 2023

"The FTX Group lacked independent or experienced finance, accounting, human resources, information security, or cybersecurity personnel or leadership, and lacked any internal audit function whatsoever. Board oversight, moreover, was also effectively non-existent."

“if Nishad [Singh] got hit by a bus, the whole company would be done. Same issue with Gary [Wang]."

Show threadMolly WhiteApr 9, 2023
Some new context on the sudden resignation of Brett Harrison in September 2022: he "resigned following a protracted disagreement", after which his bonus was drastically reduced.
Show threadMolly WhiteApr 9, 2023
In a separate instance, a lawyer who was hired only three months prior, who learned about the North Dimension bank accounts, was "summarily terminated after expressing concerns about Alameda’s lack of corporate controls, capable leadership, and risk management."
Show threadMolly WhiteApr 9, 2023
"At the time of the bankruptcy filing, the FTX Group did not even have current and complete lists of who its employees were."
Show threadMolly WhiteApr 9, 2023
"As a general matter, policies and procedures relating to accounting, financial reporting, treasury management, and risk management did not exist, were incomplete, or were highly generic and not appropriate for a firm handling substantial financial assets."
Show threadMolly WhiteApr 9, 2023

More QuickBooks shade.

"Fifty-six entities within the FTX Group did not produce financial statements of any kind. Thirty-five FTX Group entities used QuickBooks as their accounting system and relied on a hodgepodge of Google documents, Slack communications, shared drives, and Excel spreadsheets and other non-enterprise solutions to manage their assets and liabilities"

Show threadMolly WhiteApr 9, 2023
"Approximately 80,000 transactions were simply left as unprocessed accounting entries in catch-all QuickBooks accounts titled 'Ask My Accountant.'"
Show threadMolly WhiteApr 9, 2023
Sam Bankman-Fried: "Alameda is unauditable... we are only able to ballpark what its balances are, let alone something like a comprehensive transaction history. We sometimes find $50m of assets lying around that we lost track of; such is life"
Show threadMolly WhiteApr 9, 2023
"Thousands of deposit checks were collected from the FTX Group’s offices, some stale-dated for months, due to the failure of personnel to deposit checks in the ordinary course; instead, deposit checks collected like junk mail."
Show threadMolly WhiteApr 9, 2023
Transfers in the tens of millions of dollars were approved via Slack emoji, or discussed in disappearing Signal or Telegram chats.
Show threadMolly WhiteApr 9, 2023
"Only four months after the real estate purchase had closed did the employee enter into a promissory note with Alameda in which he undertook to repay the funds used to purchase the property. Other insiders received purported loans from Alameda for which no promissory notes exist."
Show threadMolly WhiteApr 9, 2023
Accounts were opened using names and email addresses that were not obviously linked to FTX, using pseudonymous email addresses, in the names of shell companies created for these purposes, or in the names of individuals (including individuals with no direct connection FTX)
Show threadMolly WhiteApr 9, 2023
"Alameda also transferred funds to insiders to fund personal investments, political contributions, and other expenditures—some of which were nominally 'papered' as personal loans with below-market interest rates and a balloon payment due years in the future."
Show threadMolly WhiteApr 9, 2023
The document reiterates known allegations about Alameda's "unique ability to trade and withdraw virtually unlimited assets [on FTX], regardless of the size of its account balance and without risk of its positions being liquidated."
Show threadMolly WhiteApr 9, 2023
The FTX group had no cybersecurity staff whatsoever.
Show threadMolly WhiteApr 9, 2023
FTX stored private keys to its crypto wallets in AWS 🫠
Show threadMolly White
"[FTX] kept virtually all crypto assets in hot wallets... [FTX] undoubtedly recognized how a prudent crypto exchange should operate, because when asked by third parties to describe the extent to which it used cold storage, it lied."
Apr 9, 2023 at 11:59pmWeb
Show threadMolly WhiteApr 10, 2023
An employee wrote in internal communications that they had been "instructed that this information was not to be shared with regulators unless it was specifically requested. Another FTX Group employee responded that if the question was being posed by 'non-regulators,' then 'we say 10% in hot wallet, and 90% in cold wallet'"
Show threadMolly WhiteApr 10, 2023
FTX generally didn't use multisigs. When they did, they stored all of the keys together in one place, thus defeating the purpose.
Show threadMolly WhiteApr 10, 2023

Debtors give multiple examples of irresponsible key storage. Keys to >$100M stored in unencrypted plaintext, for example, or in tools unsuitable for the job. Keys were often accessible by many employees with no auditing. Keys were poorly labeled, with names like "use this".

swear to god my palms just started sweating reading that lol

Show threadMolly WhiteApr 10, 2023
"Passwords for encrypting the private keys of wallet nodes were stored in plain text, committed to the code repository (where they could be viewed by many and were vulnerable to compromise), and reused across different wallet nodes"
Show threadMolly WhiteApr 10, 2023
"Over a dozen people had direct or indirect access to the FTX.com and FTX.US central omnibus wallets, which held billions of dollars in crypto assets"
Show threadMolly WhiteApr 10, 2023
FTX didn't enforce use of multi-factor authentication for Google Workspace or 1Password, which the debtors note is ironic given tweets like this:
Show threadMolly WhiteApr 10, 2023
FTX "failed by any measure" to perform basic cybersecurity practices including "creation and collection of logs that record and reflect activity within the computing environment, and systems to alert designated personnel to suspicious activity."
Show threadMolly WhiteApr 10, 2023
"Due to the lack of such controls, the FTX Group did not learn of the November 2022 Breach until the Debtors’ restructuring advisor alerted employees after observing, via Twitter and other public sources, that suspicious transfers appeared to have occurred"
Show threadMolly WhiteApr 10, 2023
Unsurprisingly given their lack of attention to cybersecurity, FTX didn't use any endpoint protection and failed to patch their software — in one case running software nearly 4 years out of date.
Show threadMolly WhiteApr 10, 2023
Nishad Singh was supposed to be in charge of cybersecurity, but wouldn't even provide the IT person with ID information of the corporate devices he was using.
Show threadMolly WhiteApr 10, 2023
Application secrets that could've transferred billions of dollars' worth of crypto assets from hot wallets or third party exchanges were stored in widely accessible source code repositories.
Show threadMolly WhiteApr 10, 2023
FTX was "highly vulnerable" to supply chain attacks and "did not review, test, or otherwise deploy its code in a manner that sufficiently ensured that it was functioning as expected and free of vulnerabilities that might be leveraged by malicious actors."
Show threadMolly WhiteApr 10, 2023
While outlining some of the difficulties they faced in identifying and securing crypto assets, the debtors say they "had to engineer technological pathways to transfer many types of assets they identified to cold storage because the FTX Group had never engaged in the computer engineering necessary to make those transfers possible."
Show threadMolly WhiteApr 10, 2023
The report concludes by stating that the debtors have recovered and secured more than $1.4 billion in crypto assets, and have identified another $1.7 billion they're working to recover.
Show threadElon Musk stickApr 10, 2023
@molly0xfff it’s almost like the whole thing was a scam….. almost
Show threadMichael KohneApr 10, 2023
@masterdon @molly0xfff It really feels more like a bunch of teenagers who are screwing around with no thought of consequences. If it were intended as a scan, you'd think they would be more competant at it.
Show threadElon Musk stickApr 10, 2023

@mhkohne @molly0xfff who said you needed to be competent to scam people?

I know of one incompetent scammer from NY who ended up president of the USA

Show threadMichael KohneApr 10, 2023
@masterdon @molly0xfff Man I hate when you are right about stuff like this.
Show threadTiMApr 10, 2023
@molly0xfff this thread is insane! How were they this absurdly incompetent?!
Show threadRojCowlesApr 10, 2023

@timlcunningham @molly0xfff

I'm curious how they could be this comically incompetent and yet were still able to put themselves in control of 10s of billions of $$$ of other people's money.

Show threadUnlettered PeasantApr 10, 2023

@RojCowles @timlcunningham @molly0xfff
Marketing. VCs. FOMO.

Madoff is an interesting corollary (though there are others). He cofounded NASDAQ and was a pioneer in computerized trading and market making. Yet his investment advisory business had no online access and statements were printed from dot matrix printers

Most cons are great sales jobs. FTX was no different. They talked a lot about their sophisticated risk management engine....we see how that worked out

Show threadUnlettered PeasantApr 10, 2023
@timlcunningham @molly0xfff
Honestly, I've been around IT a while and both tangential and involved in efforts to fix some of things mentioned here. The stuff I have seen....hundreds of DB passwords stored in a text file called DB passwords stored on DBAs desktops, cybersecurity leads more interested in busting peoples browsing history rather than organizational security, no encryption, people charged with infosec not knowing the difference between encryption at rest and in transit...many more
Show threadZorin =^o.o^=Apr 10, 2023

@timlcunningham @molly0xfff Because in the end, cryptocurrency is a scam and anyone suggesting different is in on it or being taken.

It's that simple.

Show threadSimon JonesApr 10, 2023
@molly0xfff thanks for an astonishing thread, seems my small digital agency has better security than a crypto exchange!
Show threadFrank Bennett 🇯🇵Apr 10, 2023
@molly0xfff The eyes begin to glaze over in defense of sanity, then the next paragraph rips off the membrane and the cycle starts anew. The complacent VCs that touted this circus should have their noses rubbed in this report, as one would do with a rambunctious puppy that has severed the limb of one's child.
Show threadluckysitsinbackApr 10, 2023

@molly0xfff

https://mstdn.social/@luckysitsinback/110176153925505014

luckysitsinback (@[email protected])

like being forced to play a real-life Chutes and Ladders in the nude.

Mastodon 🐘
Show threadluckysitsinbackApr 10, 2023

@molly0xfff

ODDS THAT THE SECOND REPORT will be longer, with more names ... ?

Show threadUlrikeApr 10, 2023
@molly0xfff
Incredible.
Show threadZardozApr 10, 2023
@molly0xfff great thread, thank you!
Show threadDenis RobertApr 10, 2023
@molly0xfff one thing though: most smaller companies are vulnerable to supply-chain attacks, and even some of the larger ones. It’s a common problem. The Log4J vulnerability exposed this very starkly.
Show threadMolly WhiteApr 10, 2023
@drobert most smaller companies are not processing billions of dollars worth of transactions
Show threadDenis RobertApr 10, 2023
@molly0xfff true.
Show threadUnlettered PeasantApr 10, 2023
@drobert @molly0xfff
I think the Solarwinds hack is a great example of supply chain vulnerabilities. Supply chain vulnerability management/detection/remediation is interesting theory wise, but implementing appropriate controls and systems is exceptionally difficult, as the vectors of attack are large and unpredictable. Good cybersecurity, in general, can help. But it can be really hard to do well, in small and large organizations.
Show threadLorentzApr 10, 2023
@molly0xfff SBF will be going to jail for a long, long time, it seems.
Show threadAlkaApr 10, 2023
@molly0xfff why would they use protection when they were just going to steal the money themselves anyway
Show threadKofi Loves Efia Apr 10, 2023
@molly0xfff you just know somewhere the guys at lockbit revil blackbasta et al are just sobbing into their borscht that they missed this
Show threadTess, Joint Chief of StiffApr 10, 2023

@molly0xfff Fucking hell how did it not get attacked and lose everything?

Was their accounting so unfathomable that no-one who hacked in could find the funds either? :P

Show threadDarryl RammApr 10, 2023
@molly0xfff Is you taking log records of a criminal fucking conspiracy?
Show threadpmac_Apr 10, 2023
@molly0xfff tech bros gotta tech bro ... I would be so fired (not) doing things like that
Show threadBenjamin JohnsApr 10, 2023
@molly0xfff Thinking about how I've never once thought about how many people at my bank have "access to the master password" to transfer all the bank's assets to a random account somewhere, because even if that wasn't on its face an absurd concept, if something like that DID happen, the bank would say "we fired that guy, undo" and the other bank who owned the other account would just, give it all back.
Show threadsa_zhApr 10, 2023
@Theoreticalb @molly0xfff the swift network heist at Bangladesh bank is an example that fraudulent transactions cannot always be traced and reverted. A large sum still has not been recovered to this day (6 years later).
https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery
Bangladesh Bank robbery - Wikipedia

Show threadprozacchiwawaApr 10, 2023
@molly0xfff thinking on the poor security practices, ftx and execs would have been far better off losing a few billion via a platform exploit than being the only obvious cause of the collapse. almost a bit surprising nobody tried a fake compromise as a way out before the bankruptcy.
Show threadMolly WhiteApr 10, 2023
@prozacchiwawa that's still a distinct possibility
Show threadKofi Loves Efia Apr 10, 2023
@molly0xfff seems legit
Show threadColorblind CowboyApr 10, 2023
@molly0xfff Oh Jesus, really? Not even converted to pig Latin?
Show threadOfOtherWorldsApr 10, 2023
@molly0xfff When our bishop found out that my little parish church stored passwords in unencrypted plaintext, he was apoplectic.
Show threadRoy WigginsApr 10, 2023
@molly0xfff how in god's name did they make it as long as they did without some insider just pocketing the money and disappearing
Show threadFrank Millheim Apr 10, 2023
@roywig @molly0xfff *Sam Trabucco has entered the chat*
Show threadRoger MooreApr 10, 2023
@roywig @molly0xfff
My guess is they had problems with people pocketing money, but they didn't bother disappearing. The accounting system was tailor made to protect embezzlement, so the embezzlers weren't afraid of getting caught. Disappearing would just draw attention to the theft.
Show threadRoy WigginsApr 10, 2023
@VATVSLPR @molly0xfff probably true. What's a few million here or there?
Show threadRoger MooreApr 10, 2023
@roywig @molly0xfff
It's hard to set up a good accounting system when the guy at the top doesn't want one because it would expose his crimes.
Show threadSteve's PlaceApr 10, 2023

@molly0xfff I'm upset with myself for not better labeling 4 templates I emailed. Aghast at this! This is what a den of thieves would do to help their mates fill their coffers! Looks deliberate from the outset to my eyes. Gah!!!

The Land Without Regulation Enforcement is a horrible movie!!

Show threadVissApr 10, 2023
@molly0xfff this is spectacular asshattery
Show threadMarc JacobsApr 10, 2023
@molly0xfff Maybe they used extra special post-it notes to write them down, 😂
Show threadKyle RoseApr 10, 2023
@molly0xfff 😳
Show threadbassplayerApr 10, 2023
@molly0xfff oof poor opsec
Show threadmarcinkApr 10, 2023

@molly0xfff My brain just started adding "such is life" when reading all these quotes and excerpts.

Thanks for sharing these.

Show threadAnthonyApr 10, 2023
@molly0xfff
use this
use this 2
use this 2 for real
use this 2 for real final
Show threadSteve TorrenteApr 10, 2023
@molly0xfff "usethis_new_2"
Show threadRoger MooreApr 10, 2023
@molly0xfff
When I read this kind of thing, I tend to assume it's malice rather than incompetence. One of the main purposes of accounting is to catch insiders stealing from the company. A lack of accounting shows the thieves are in charge and don't want their theft discovered.