Some Insights about this analysis - Big wall of Addresses i used

• There are wallets which brings problems such as:
  • 0xd8019a114e86ad41D71a3EeB6620b19Dd166A969: This wallet is a meme token holder such as “FTX Bankruptcy”, which have several political and ftx related meme tokens, in this transaction FTX Exchange transfer back BTMXBULL which nowadays it doesn’t hold value but messes with the analysis, there is a lot of tokens which lost their value after a this incident and i decided to include here some of their names:
    • ('HEDGESHIT', 'BEARSHIT', 'TRUMPWIN', 'TRUMPLOSE', 'BULLSHIT', 'MEDIA', 'EOSHEDGE', 'RAY', 'BNBBEAR','EXCHBEAR') are somes of the tokens which i have to filter.
    • There is more tokens which ends with BEAR/BULL/EDGE which also messes with the data.
• Using Flipside label table i found the following addresses:

FTX Wallets:

0x97f991971a37d4ca58064e6a98fc563f03a71e5c - Treasury (it hold a lot of differents tokens)

0x2faf487a4414fe77e2327f0bf4ae2a264a776ad2 - FTX Exchange (affected by the hack)

0x7abe0ce388281d2acf297cb089caef3819b13448 - FTX US (Affected by the hack)

Alameda Wallets:

0xe31a9498a22493ab922bc0eb240313a46525ee0a

0x073dca8acbc11ffb0b5ae7ef171e4c0b065ffa47

0x712d0f306956a6a4b4f9319ad9b9de48c5345996

0xe5d0ef77aed07c302634dc370537126a2cd26590

0x93c08a3168fc469f3fc165cd3a471d19a37ca19e

0xc5ed2333f8a2c351fca35e5ebadb2a82f5d254c3

0x3507e4978e0eb83315d20df86ca0b976c0e40ccb

0x0c0fe4e0236480e16b679ee1fd0c5247f9cf35f0

0xa726c00cda1f60aaab19bc095d02a46556837f31

0xbefe4f86f189c1c817446b71eb6ac90e3cb68e60

Wallets without label in eth scanner, but it has FTX label in Flipside

0xff3babb82a8065318a0548e4af19e0ed46dc28f9 - 2M USDT

Less than 1 Million

0xaae7ac476b117bccafe2f05f582906be44bc8ff1

0xa3b7c7804d21e18c11e7aeec9cda5eae6d160ece

Less than 100k

0xeb3ccf68eb065c39e13e80b9820c0e69c9efd41b

0x414fe2f1d70778ca1cbe9cd4604aebefa4441d77

0xeabf02e7c66e0c0262092267a9ee3da06de35c43

0xabda3703517e75db5f539e5b8c0081de118023be

0xae57851c5d7a3a4162249eb7ca45fbc20dd74057

0x807c413bab74e4a7aea06cdd03436ddaeee204ef

Less than 20k

0xe5d46134bef146f8c03c1b736b6af4e5d9becc1c

0x9eef157d003ada5ac908eccfe6bc3cc460227bf6

0x93ef90f3b2b93fa0da997ef53b789441bb4a0cc4

0x5a1f22b9ceadff038f17b60dfde76c3b02828022

0x9e82752875292fc50a73ac40ad536ca0c56dae19

Less than 10k

0x1106855eb1ddaf4a267923f54c20c3e230de83b1

0x928ab22991e006a5b50e52d4225b602d3f9bcc5d

0x2103801b25998fb56e463e65cb458b2b905fae78

0x3abeeb8623ea96fb1e5d8d5982fd7b26deacebe9

0x4f8eb72f93eb668877889781c2007fc0dca1b0c3

0x0824ec9d2704f0e229c306a7a9365eec1f4ba1ec

0x2103801b25998fb56e463e65cb458b2b905fae78

Less than 5k

0xb1f4e60a05e1e69acc7ce222072fefc2174bae70

0xe20b6cfa4aaedef4075b816850569763ecca2a3c

0xaa261ce05f40e0a5ca3069154e6108467ccc1a0f

0xf8e8a0abbc0e7e9729f91f6aa2700f02c492c201

0x04b5293561785ff616c41fc217722ac8b97fd79b

0x4e1651992c73aa29dd91ae1c18eabdd1c4d185a5

0x9dc8ec989ff46c6ba6c789f1f44990e22de45431

0x61e133bbe8f795226e8263419af48d37576ecb23

0x3306ea7ab30633b80e550995ccf9c49cc3d624fa

0x5394884059d0beaa1b45fd457e0f8977d68ca4be

0xdb3088b2679517c3bb0b5087ff4a212e6f7f763c

0x74d0bdfed95e9d6023ef45ba955890afe8afec33

The story so far…

• After an article from coindesk regarding Alameda balance sheet, besides that the highest amount in the report was from FTT, the token from FTX Exchange, their “sister company” there was a question which wasn’t answered:

  • Where is the source of the company’s 8 billion dollar loan?.

• Caroline, the CEO of alameda published a twitter regarding this article, but wasn’t enough and Binance CEO starts tweeting about liquidate their FTT.

  • The answer from both CEO’s of Alameda and FTX was that they were going to buy that FTT.

• The main reason for the actions of Binance CEO was to avoid another Luna incident, and because of these tweets, and the fear from another Luna Crash, people starts to withdraw their funds, which led to Alameda and FTX crashing into the ground.

  • FTT token value plummeted down, which led to FTX to sold their SOL plummeting down their price.
  • All the cryptoworld was suffering a big downtrend in prices during the fall of FTX and a lot of investors start to leave.

• In the end FTX declares their bankruptcy in November 11, and their CEO Sam Bankman-Fried steps out.

  What Happened now then?

• In November 12 FTX wallets suffer a hack, ETH and SOL was transfer to new accounts created in Ethereum and Solana, it seems that this wasn’t an external attack and more that some from the inside stole the remaining customers money that were in the wallets

• There was a lot of activity for the new accounts and a lot of Meme tokens where moving to the heist wallets and the FTX wallets.

• FTX Group has established Kroll as its claims agents.

  There is a lot of articles about what happened but you can read here the interview to SBF, in the end it doesn’t matter who’s right or wrong, the damage is already done, and we hope that blockchains can regain the people trust again, after all the incidents from this year.

Alameda & FTX in Ethereum

There is a lot assets in FTX, that’s because it’s an exchange, so it have a lot of tokens, we can see that alameda influence is small in comparison with FTX.

The chart above is in log scale, if we look to the donut chart we can see that most of the volume comes from 2 tokens FTX and USDC, BOBA as the third and SRM fourth.

If we look at the donut chart below from the top 10, after the BOBA token, most percentage is lower than 10 so most of the tokens don’t add too much volume to these companies,

It’s seems that most of the volume from Alameda comes from USDC with almost 100M, FTX token with 72M of USD Volume for the FTX exchange, and Boba with 27M, the others 17 tokens all have volume over the million

General Metrics from the Analysis Above

Most of the Volume, Wallets and tokens come from FTX, and alameda didn’t participate too much, so i’ll use this opportunity to analyze the companies individually

So in resume, there is a lot of wallets which hasn’t the FTX label in Etherscan, so i’ll analyze these wallets for FTX and the wallets from Alameda Individually now.

FTX_US only have ETH as volume and it lost something after the hack.

FTX_Exchange have more assets, it’s seems that BTMX have a lot of value here, but in reality their price drop down, only that these price isn’t updated correctly in flipside table!.

But most of the volume comes from the following account i named treasury, mostly because it holds a large quantity of Tokens

This wallet have most of the volume and tokens of FTX, and most of the volume is from FTX token, most of the stablecoins presents have little volume.

It has more tokens but i only included these which have at least more than 100k in usd volume

Most of the Alameda volume comes from USDC, and it’s from “0xe31…ee0a” address (you can look in the wall of address above the ethscanner link)

Alameda and FTX in Solana

Note: I didn’t have the time to look for the Solana balances, i’ll reuse some charts from my previous report about Solana and FTX&Alameda

Most of the volume was from Alameda and FTX to the users, this outflow of volume spiked at november 9.

Stablecoin volume was highest than solana.

Most of the Outflow was going to kraken and coinbase, gate.io also received a lot of stablecoin volume.

I decided to use an image from the Solscan of the address JBpj7yp4Afvb71TmanVwJZXGeX4kqbGFvjCFCRo3EbTM which was the address from FTX which was hacked and lost SOL.

This is only the balance of 1 FTX address, but it’s seem to be the treasury from Solana (because it have 40 assets tokens and more than 15k NFTs) , and most of the volume comes from Wrapped Bitcoin, USDT, ETH, Chainlink.

How affected the Hack to FTX

The hack was made in 3 transactions, 1 in Solana of 145k SOL (99% of their total SOL), and 2 in Ethereum for 10k ETH from FTX_US and 9.5k from FTX Exchange.

Most of the assets were swapped and moved by differents accounts in Ethereum, ftx drainer 1 was the address which received the 19.5k ETH stolen, and then starts to swap to differents assets and move it to differents accounts which are the reimaining ftx drainer.

0x59abf3837fa962d6853b4cc0a19513aa031fd32b ftx drainer 1

0xc40abf7e6499694ea6f965df96e39e51305e019a ftx drainer 2

0x5ea8132c16d6fa409c65d48c5e093a0dffa0d253 ftx drainer 3

0x9c43cbfc046889159d4d53e0069737a7a142a369 ftx drainer 4

0x585ed783c9246553e8bc9f9046c80f54afee7765 ftx drainer 5

0x2cb356d17ce28135d593795de6a398f2b997a69f ftx drainer 6

0xadb8ddf11607fc5faf1d6b50beed9f6c3577203e ftx drainer 7

0x23a43cf429ec32ebca4624e2182a799141425556 ftx drainer 8

0x961baeb17b99da67daba6de02933fa0195cb425e ftx drainer 9

0x29bd06bfb1b52bdae3190f7151ec0367b745b67f Ftx drainer 10

Solana hacker wallet 6sEk1enayZBGFyNvvJMTP7qs5S3uC7KLrQWaEk38hSHH.

Summary

• Most of the Volume in FTX is FTX token, and the rest of the remaining assets this exchange have.

• Alameda seems to learn from the past and now most of their volume is the stablecoin USDC, and have a little volume of FTX.

• Both Companies have 1 or 2 wallets with almost all the volume.

• Hacker create new accounts to move the volume stolen.

  \

Methodology

• Using Flipside data tables:

  • solana.core.fact_transfers: To get info about the hack.
  • ethereum.core.ez_eth_transfers: To get info about the hack
  • ethereum.core.ez_current_balances: To get info about the balances

  \