[Thread] A look at a report from FTX debtors on the company's control failures, like awful recordkeeping, lying about using cold wallets, and sloppy key storage
Document #1242, Attachment #1 Mark Timmis / Coinmonks : Curious Cryptos' Commentary 10th April 2023 — FTX FTX : FTX Debtors Release Report on FTX Group's Control Failures Martin Young / Cointelegraph : FTX's bankruptcy lawyers and advisers pocket $32.5M in February Victoria Cavaliere / Bloomberg : FTX Failure Rooted in ‘Hubris,’ ‘Greed,’ Debtors Report Says Colin Wilhelm / The Block : ‘Hubris’, hot wallets and missing millions: FTX's new bankruptcy report Siamak Masnavi / CryptoGlobe : FTX Group's House of Cards: Uncovering a World of Mismanagement and Lack of Control Kyle Barr / Gizmodo : ‘Such Is Life:’ FTX Says SBF and Execs Joked About Misplacing Millions of Dollars Cheyenne Ligon / CoinDesk : Former FTX US President Reportedly Quit After ‘Protracted Disagreement’ With Bankman-Fried Eli Dambell / Bitcoinist.com : New Court Filing Shows FTX Kept Crypto Wallet Keys On AWS Denis Om / CryptoSlate : Report shows FTX saved crypto wallet credentials on AWS Timmy Shen / Forkast : FTX's lack of financial controls complicates bankruptcy asset recovery, says legal filing LinkedIn: Anton Golub : I have been in the crypto industry for 10 years, running a crypto exchange & market-maker, and it's fascinating to have an insider insight … Mastodon: Kevin Beaumont / @GossiTheDog@cyberplace.social : This thread on FTX's crypto bankruptcy is absolutely hilarious, if you ignore the victims. FTX was seen as one of the most prestigious and stable crypto companies.. Jesus Christ. https://hachyderm.io/... Tweets: Molly White / @molly0xfff : Debtors give multiple examples of irresponsible key storage. Keys to >$100M stored in unencrypted plaintext, for example, or in tools unsuitable for the job. Keys were often accessible by many employees with no auditing. Keys were poorly labeled, with names like “use this”. https://twitter.com/... Molly White / @molly0xfff : FTX stored private keys to its crypto wallets in AWS 🫠 https://twitter.com/... Conor / @jconorgrogan : Chart of the balance of Alameda Wallets (Jan '18- June '20) The blue dot is when Nishad Singh altered the codebase to enable Alameda to withdraw unlimited amounts of crypto from FTX https://twitter.com/... Wu Blockchain / @wublockchain : FTX creditors released the first report, mainly describing the reasons for the failure of FTX, including: SBF has the final say in all major decisions; core personnel have no risk management and operation experience shortly after graduating from university; James Meickle / @jmeickle : think about what this implies for any company who put money into FTX not even the barest amount of due diligence into their partner, not even asking if they have a CISO much less actually meeting them It's a slam dunk for any lawsuits. Molly White / @molly0xfff : “The FTX Group lacked independent or experienced finance, accounting, human resources, information security, or cybersecurity personnel or leadership, and lacked any internal audit function whatsoever. Board oversight, moreover, was also effectively non-existent.” https://twitter.com/... Ben Kehoe / @ben11kehoe : To paraphrase @matt_levine's view of FTX's balance sheet, FTX's security architecture was also full of the howling of ghosts and the shrieking of tortured souls https://twitter.com/... Molly White / @molly0xfff : Application secrets that could've transferred billions of dollars' worth of crypto assets from hot wallets or third party exchanges were stored in widely accessible source code repositories. https://twitter.com/... Molly White / @molly0xfff : “[FTX] kept virtually all crypto assets in hot wallets... [FTX] undoubtedly recognized how a prudent crypto exchange should operate, because when asked by third parties to describe the extent to which it used cold storage, it lied.” https://twitter.com/... Mayne / @tradermayne : 1) What. https://twitter.com/... @bitfinexed : There's a reason why Sam Bankman-Fried was Tethers largest customer. He's the same exact kind of fraud as Tether. Tether is also a hedge fund, secretly. Their own bankers said so. https://twitter.com/... @moo9000 : In Japan, the crypto regulation is good because it is an industry self-regulatory body. This is why FTX Japan was saved. @tmnxeq : A couple of privileges that FTX secretly granted to Alameda in July 2019...interesting timing 🧐 https://twitter.com/... @idrawcharts : this is actually wild lmao even FTX didn't know how much money you (or they) had @defiyst : Don't recall seeing any public info before on FTX's opsec? Looks like FTX/Alameda was punting with users funds all via hot wallets. https://twitter.com/... @0xg00gly : Some good news https://twitter.com/... @cryptonator1337 : ‘In fact, neither of these assertions about cold storage use was true.’ https://twitter.com/... Brett Harrison / @brettharrison88 : Not sure how this is “new,” as I've written and spoken publicly about the circumstances of my resignation from FTX US a number of times since January. @wawin : jesus christ what a clownshow ftx was https://twitter.com/... @coinbureau : FTX debtors just released a report on the failings of the exchange and boy, is it a shocker. It's actually a miracle that they didn't suffer severe numerous severe hacks before the collapse 🤯 https://twitter.com/... Alvin Foo / @alvinfoo : “Hubris, incompetence, and greed” led to the implosion of crypto exchange FTX. #FTX lacked basic accounting and financial controls and was under the command of a small group of individuals who “stifled dissent.” https://www.businessinsider.com/ ... @mayhem4markets : Wow, FTX was horribly mismanaged in every way possible. A total security nightmare. If they didn't go down the way they did they would have been hacked badly... https://twitter.com/... @zhusu : While the fall of alameda/ftx is being cast as a uniquely damning biz failure, reality is many exchanges today practice all the same behaviors When @therealleslamb0 described to me the idea of @OPNX_Official, an exchange that refuses to compete w clients, i had to learn more @nash076 : I would say FTX is indistinguishable from an organized crime entity except I'm willing to bet the mob has better accounting practices. @aftxcreditor : FTX has filed a response to the UCC, arguing they have already provided a roadmap including timeframes. They plan to share this roadmap with the court on April 12th. https://twitter.com/... @0xabad1dea : little a disaster tourism, as a treat https://twitter.com/... Nate Igor Smith / @drivenbyboredom : This is absolutely bonkers. https://twitter.com/... @antonhand : If you'd like to have an aneurysm, this is a fantastic read of a thread. https://twitter.com/... Molly White / @molly0xfff : FTX “failed by any measure” to perform basic cybersecurity practices including “creation and collection of logs that record and reflect activity within the computing environment, and systems to alert designated personnel to suspicious activity.” Molly White / @molly0xfff : “Over a dozen people had direct or indirect access to the FTX.com and FTX.US central omnibus wallets, which held billions of dollars in crypto assets” @blackamazon : I ... i ... I WORKED IN COMMS AND MODERATION AND STRATEGY MY MIRO BOARDS ARE BETTER PROTECTED https://twitter.com/... Brad Michelson / @bradmichelson : The more I read about this the more shocked I am. I still can't believe a company operating at this scale ran this way. https://twitter.com/... Molly White / @molly0xfff : The debtors reiterate the stunning lack of recordkeeping and controls at FTX: “Normally... there are readily identifiable records, data sources, and processes that can be used to identify and safeguard assets of the estate. Not so with the FTX Group.” Molly White / @molly0xfff : “Approximately 80,000 transactions were simply left as unprocessed accounting entries in catch-all QuickBooks accounts titled ‘Ask My Accountant.’” https://twitter.com/... Molly White / @molly0xfff : Some new context on the sudden resignation of @BrettHarrison88 in Sept. 2022: he “resigned following a protracted disagreement”, after which his bonus was drastically reduced. https://twitter.com/... Molly White / @molly0xfff : Sam Bankman-Fried: “Alameda is unauditable... we are only able to ballpark what its balances are, let alone something like a comprehensive transaction history. We sometimes find $50m of assets lying around that we lost track of; such is life” https://twitter.com/... Molly White / @molly0xfff : FTX didn't enforce use of multi-factor authentication for Google Workspace or 1Password, which the debtors note is ironic given tweets like this: https://twitter.com/... Wu Blockchain / @wublockchain : July 31, 2019 Singh changed the code base to allow Alameda to withdraw unlimited amounts of crypto assets from FTX; and a week later modified it to exempt Alameda from automatic liquidation; the FTX group kept almost all crypto assets in hot wallets (SBF lied about using cold... https://twitter.com/... Jameson Lopp / @lopp : Even had FTX been a legitimate business operation, they would have eventually lost everyone's money with these security practices. https://twitter.com/... Molly White / @molly0xfff : “Due to the lack of such controls, the FTX Group did not learn of the November 2022 Breach until the Debtors' restructuring advisor alerted employees after observing, via Twitter and other public sources, that suspicious transfers appeared to have occurred” https://twitter.com/... Molly White / @molly0xfff : Nishad Singh was supposed to be in charge of cybersecurity, but wouldn't even provide the IT person with ID information of the corporate devices he was using. https://twitter.com/... Molly White / @molly0xfff : Unsurprisingly given their lack of attention to cybersecurity, FTX didn't use any endpoint protection and failed to patch their software — in one case running software nearly 4 years out of date. https://twitter.com/... Molly White / @molly0xfff : FTX generally didn't use multisigs. When they did, they stored all of the keys together in one place, thus defeating the purpose. https://twitter.com/... Molly White / @molly0xfff : An employee was “instructed that this information was not to be shared with regulators unless it was specifically requested. Another FTX Group employee responded that if the question was being posed by ‘non-regulators,’ then ‘we say 10% in hot wallet, and 90% in cold wallet’” https://twitter.com/...
Context & Ripple Effects
The debtors’ report adds operational detail to earlier accounts of a “paperless” bankruptcy and the reported commingling of FTX and Alameda assets. Rather than treating the collapse as solely a balance-sheet failure, it documents the access controls, recordkeeping, and wallet practices that made customer-asset misuse hard to detect.
The findings also give a technical basis for questions raised after FTX lawyers reported assets stolen from accounts during the bankruptcy process. Insecure key handling, broad wallet access, and reliance on hot wallets make asset tracing and custody reconciliation materially harder.
First-order effects
- FTX debtors, creditors, and investigators gain a more specific record of the systems and personnel permissions relevant to tracing assets and assigning responsibility for control failures.
- The report directly undermines FTX’s custody representations: broad access to central wallets and plaintext or accessible keys weaken the distinction between customer custody and internal operational funds.
Second-order effects
- Bankruptcy recovery work becomes more dependent on reconstructing transaction records and access histories, not simply matching customer balances to segregated wallets; the earlier evidence of commingled assets makes that reconstruction central.
- Centralized crypto venues face sharper scrutiny of wallet segregation, privileged-account controls, and independent audit trails, while custody vendors can differentiate on demonstrable key-management and access-governance practices.
Third-order effects
- If these failures prove representative of weakly governed exchanges, crypto-market trust will increasingly rest on verifiable custody controls and auditable internal permissions rather than public claims about cold storage.
- The episode supports a shift toward treating exchange software privileges and wallet-key access as governance issues: code-level exceptions can override nominal customer-protection policies unless independently controlled.
The trend: FTX is a prominent case in the broader move from reputation-based crypto custody toward auditable controls over assets, keys, and privileged software access.