By Eric Vandenbroeck and co-workers

We started with this subject after a reader sent us a copy of the recently poorly written and inaccurate book Tracers in the Dark By Andy Greenberg. We double-checked its content and realized that non of the severe crypto criminals (which included Sam Bankman-Fried) were even mentioned in the book. When we then wrote our Part One, followed by Part Two and Part Three, and now Part Four, where we finalize our investigation of the Macroeconomic Impacts of the Crypto collapse and the undercollateralized, overcollateralized, and fiat-backed stablecoins. It is also known that Sam Bankman-Fried's collapsed cryptocurrency exchange FTX himself has more than $5bn (£4.1bn) of assets. Prosecutors have accused FTX's former chief executive Sam Bankman-Fried of orchestrating an "epic" fraud that may have cost billions of dollars to investors, customers, and lenders.

The journey of FTX in and out of Hong Kong was driven by the quest for friendlier crypto regulations, according to US court documents related to lawsuits against the defunct crypto exchange’s former management, including its chief executive officer (CEO) Samuel Benjamin Bankman-Fried and his ex-girlfriend Caroline Ellison.

FTX, once the world’s third largest crypto exchange valued at $32 billion, filed for Chapter 11 bankruptcy protection in the US on November 11. Bankman-Fried, who co-founded FTX, pleaded not guilty to eight criminal charges in a New York court on January 3, according to media reports. The charges include fraud, money laundering and illegally donating money to US politicians to foster a conducive regulatory environment for FTX. By pleading not guilty, the 30-year-old has set the stage for a potentially explosive trial tentatively scheduled for October.

Ellison and Gary Wang, a co-founder of FTX, pleaded guilty to fraud charges last December 19. Ellison is the former CEO of Alameda Research LLC, a crypto hedge fund previously majority-owned by Bankman-Fried. They are likely to be jailed in the US for years. Bankman-Fried co-founded Alameda in November 2017 in a three-bedroom apartment in Berkeley, California, USA, with the downstairs serving as its office, said a lawsuit filed in the US bankruptcy court for Delaware on December 27. The plaintiffs are Americans Austin Onusz and Nicholas Marshall, a Turkish citizen named Hamad Dar, and a Dutchman named Cedric Kees van Putten. The defendants include FTX Trading, Alameda, Bankman-Fried, Ellison, and Wang.

In late 2018, Alameda “moved its headquarters from California to Hong Kong due to the difficulty of establishing and maintaining relationships with banks in the US as a cryptocurrency trading firm,” said the lawsuit. Despite marketing materials offering investors and lenders “high returns with no risk” and “no downside,” finding investors and lenders were complex since banks and traditional Wall Street firms largely shunned crypto because of the lack of regulation and oversight, the lawsuit explained.

“In late 2018, the headquarters of Alameda Research was relocated to Hong Kong. The team at Alameda Research included Defendant Bankman-Fried’s close friends (and later co-founders for FTX) Nishad Singh and Gary Wang. Defendants Caroline Ellison and Sam Trabucco were also part of the group. Upon moving to Hong Kong, the group lived like college students and fiercely traded crypto,” said a class action complaint filed in the US district court of Miami on December 7. “The firm shifted to Hong Kong, partly to take advantage of arbitrage opportunities in Asian bitcoin markets – including the price discrepancy between BTC in Japan and BTC everywhere else,” said the complaint.

“According to Defendant Bankman-Fried, while attending meetings in Hong Kong, he received encouragement from large players in cryptocurrency. He summoned Defendant Wang to Hong Kong, and they went to work creating the FTX Group,” disclosed the lawsuit filed in the US bankruptcy court for Delaware.

FTX launched a crypto exchange from its Hong Kong offices on May 9, 2019, said the lawsuit. “As would later become significant, the FTX Executive Defendants did not implement internal controls over customer property when they created and launched the FTX Group, nor did they do so later.”

FTX launched its crypto token, FTT, on July 27, 2019. To maintain its price, Alameda, then based in Hong Kong, served as FTT’s leading market maker where Alameda could set prices for the token, the lawsuit said. “Moreover, by keeping half the tokens uncirculated, FTX.com (the international crypto exchange of FTX) and Alameda could artificially prop up the price while still counting the uncirculated tokens as assets.”

“The FTX Group relocated from Hong Kong to the Bahamas in September 2021, reportedly citing the favorable regulatory environment amidst regulators worldwide beginning to examine cryptocurrencies and China outlawing cryptocurrency transactions,” said the lawsuit.

On September 27, 2021, Markets Insider quoted Bankman-Fried saying FTX was moving from Hong Kong to the Bahamas due to the Caribbean nation’s crypto-friendly legal framework. Still, he denied the move was due to China banning all crypto businesses on September 24, 2021.

“Leading up to the collapse of FTX (in November 2022), Ellison lived with nine other FTX or Alameda colleagues in Bankman-Fried’s US$30 million penthouse in the Bahamas. She reportedly paid SBF rent and occasionally had a romantic relationship with him. In 2021, Ellison tweeted about recreational stimulant use. Upon information and belief, Ellison left the Bahamas and moved back to Hong Kong,” the class action complaint said.

As reported in parts one and three, Ellison and Wang are currently in the US under bail.

 

Bankman-Fried’s Hong Kong Affiliations

After FTX shifted from Hong Kong to the Bahamas in September 2021, Bankman-Fried founded a company in Hong Kong called FTX Trading Limited on September 29, 2022, according to Hong Kong corporate records. This firm had a paid-up capital of HK$10,000 (US$1,279) and was fully owned by FTX Trading Limited, a company registered in Antigua and Barbuda, which also owned FTX.com. Less than two months later, on November 11, 2022, FTX Hong Kong filed for Chapter 11 bankruptcy protection, according to Kroll, a US risk consultancy handling creditor claims on FTX.

FTX Hong Kong’s first directors were Bankman-Fried, and Jen Chan Luk-wai, a Hong Kong woman who was FTX’s chief financial officer, Hong Kong corporate records reveal. On November 9, 2022, a Hong Kong man, Clement Joshua Ip, replaced Chan as director of this short-lived company. Ip co-founded Genesis Block, a Hong Kong-based over-the-counter crypto trading firm. Genesis suffered from the collapse of FTX on November 11 and closed its trading operations on December 10, Reuters reported.

In the corporate records of FTX Hong Kong, Bankman-Fried registered an address at a flat in Star Studios I on 8-10 Wing Fung Street in Wanchai. Star Studios I is a residential tower with flats ranging from 206 to 457 square feet, which is small by US standards.

Around the time Alameda moved from Berkeley to Hong Kong on December 14, 2018, Bankman-Fried established another Hong Kong company, Cottonwood Grove Limited, according to Hong Kong corporate records. At its founding, the company had paid-up capital of HK$10,000 and was 100 percent owned by Bankman-Fried. In 2021, Cottonwood’s paid-up capital increased to HK$1.01 million, wholly owned by a British Virgin Islands company, Alameda Research Limited, Hong Kong corporate records reveal. In 2021, Cottonwood had three directors: Bankman-Fried, Charis Law Wing-man, and Jen Chan, Hong Kong corporate records show.

FTX Trading, Alameda Research Limited, and Cottonwood also filed for Chapter 11 bankruptcy protection on November 11, 2022, according to Kroll.

“The implosion of the FTX exchange also showed that the platforms themselves can be ruinously problematic in their own right. After all, the FTX case has made clear how investors seeking genuine, if risky, frontier investments can find themselves overlooking, or even excusing, the most egregious behavior,” said Steve Vickers, the CEO of Steve Vickers and Associates, a Hong Kong risk consultancy.

#Sam Bankman-Fried, mastermind of the multibillion-dollar FTX-Alameda Research fraud, pleaded not guilty to conspiracy and wire fraud. Drawing on conspiratorial theories, some have taken this as a sign that Bankman-Fried will pull strings with friends in high places to finagle his way toward acquittal.

The plea might well be strategic. Bankman-Fried might be holding out for an improved plea deal. Maybe he thinks a show of confidence can buttress public and investor faith in him or be enough to convince a jury of his innocence.

But an equally likely explanation for the decision to go to a trial in October is that Bankman-Fried and his allies are in a deep cocoon of delusion about the substance of the case. Regardless, he is unlikely to win a verdict of innocence if things proceed to trial.

As in most years, the ten largest hacks of 2021 accounted for most of the funds stolen at $1.81 billion. Seven of these ten attacks targeted (by us earlier mentioned 'DeFi platforms') in particular. The table below breaks down the details of each theft.

Total yearly cryptocurrency value received by scammers | 2017–2021

 

That represents a rise of 81% compared to 2020, a year in which scamming activity dropped significantly compared to 2019, in large part due to the absence of any large-scale Ponzi schemes. That changed in 2021 with Finiko, a Ponzi scheme primarily targeting Russian speakers throughout Eastern Europe, netting more than $1.1 billion from victims.

 

Another change that contributed to 2021’s increase in scam revenue: the emergence of rug pulls, a relatively new scam type particularly common in the DeFi ecosystem, in which the developers of a cryptocurrency project — typically a new token — abandon it unexpectedly, taking users’ funds with them. We’ll look at both rug pulls and the Finiko Ponzi scheme in more detail later in the report.

As the most effective form of cryptocurrency-based crime and one uniquely targeted toward new Scamming poses one of the biggest threats to cryptocurrency’s continued adoption. But as we’ll explore, some cryptocurrency businesses are taking innovative steps to leverage blockchain data to protect their users and nip scams in the bud before potential victims make deposits.

Total yearly cryptocurrency value received by investment scams | 2017–2021

This also tells us that the average amount taken from each victim increased.

Scammers’ money laundering strategies haven’t changed all that much. As in previous years, most cryptocurrency sent from scam wallets ended up in mainstream exchanges. 

Exchanges using Chainalysis KYT for transaction monitoring can see this activity in real-time and take action to prevent scammers from cashing out. 

The number of financial scams active at any point in the year — active meaning their addresses was receiving funds — also rose significantly in 2021, from 2,052 in 2020 to 3,300.

This goes hand in hand with another trend we’ve observed over the last few years: The average lifespan of a financial scam is getting shorter and shorter. 

September 2021, the CFTC filed charges against 14 investment scams touting themselves as providing compliant cryptocurrency derivative trading services — a common scam typology in the space —. In contrast, they had failed to register with the CFTC as futures commission merchants. Previously, these scams may have been able to continue operating for longer. As scammers become aware of these actions, they may feel more pressure to close up shop before drawing the attention of regulators and law enforcement. 

At the same time, we’re seeing the end of a long-standing statistical relationship between cryptocurrency asset prices and scamming activity. Scams typically come in waves corresponding with sustained price growth in popular cryptocurrencies like Bitcoin and Ethereum, which also lead to influxes of new users. This is reflected in the chart below — scamming activity spiked following bull runs in 2017 and 2020. This isn’t all that surprising.

New, less savvy users attracted by cryptocurrency’s growth are more likely to fall for scams than more seasoned users. However, the relationship between asset prices and scamming activity is now disappearing. Above, we see scam activity rise in concert with Bitcoin and Ethereum prices until 2021, when scamming activity stays flat and even begins to drop regardless of whether prices rise or fall. Rug pulls are the latest innovation in scamming. Rug pulls have emerged as the go-to scam of the DeFi ecosystem, accounting for 37% of all cryptocurrency scam revenue in 2021 versus just 1% in 2020. Index: Total value received by scams vs. ETH and BTC price, 30-day moving average Index.

This isn’t all that surprising. New, less savvy users attracted by cryptocurrency’s growth are more likely to fall for scams than more seasoned users. However, the relationship between asset prices and scamming activity is now disappearing.

Rug pulls have emerged as the go-to scam of the DeFi ecosystem, accounting for 37% of all cryptocurrency scam revenue in 2021 versus just 1% in 2020. 

Rug pulls are prevalent in DeFi because, with the right technical know-how, it’s cheap and easy to create new tokens on the Ethereum blockchain or others and get them listed on decentralized exchanges (DEXes) without a code audit. That last point is crucial — decentralized tokens are meant to be designed so that investors holding governance tokens can vote on how assets in the liquidity pool are used, making it impossible for the developers to drain the pool’s funds. While code audits that would catch these vulnerabilities are standard in the space, they’re not required to list on most DEXes, hence why we see so many rugs pull.

The chart below shows 2021’s top 15 rug pulls in order of value stolen.

AnubisDAO, the second-biggest rug pull of 2021 at over $58 million worth of cryptocurrency stolen, provides an excellent example of how rug pulls in DeFi work.

AnubisDAO launched on Thursday, October 28, 2021, claiming it planned to provide a decentralized, free-floating currency backed by a basket of assets. With little more than a DOGE-inspired logo — the project had no website or white paper, and all of its developers went by pseudonyms — AnubisDAO raised nearly $60 million from crypto investors practically overnight, all of whom received the project’s ANKH token in exchange for funding the project’s liquidity pool. But a mere 20 hours later, all the funds raised, primarily held in wrapped Ethereum (wETH), disappeared from AnubisDAO’s liquidity pool, moving to a series of new addresses. 

 

Finiko: 2021’s Billion-Dollar Ponzi Scheme

Fumiko was a Russia-based Ponzi scheme that operated from December 2019 until July 2021. At that point, it collapsed after users found they could no longer withdraw funds from their accounts with the company. Fumiko invited users to invest with either Bitcoin or Tether, promising monthly returns of up to 30%, and eventually launched its coin that traded on several exchanges.

According to the Moscow Times, Finiko was headed up by Kirill Doronin, a famous Instagram influencer associated with other Ponzi schemes. The article notes that Finiko was able to take advantage of challenging economic conditions in Russia exacerbated by the Covid pandemic, attracting users desperate to make extra money. Chainalysis Reactor shows us how prolific the scam was.

During the roughly 19 months it remained active, Finiko received over $1.5 billion worth of Bitcoin in over 800,000 separate deposits. While it’s unclear how many individual victims were responsible for those deposits or how much of that $1.5 billion was paid out to investors to keep the Ponzi scheme going, it’s clear that Finiko represents a massive Bitcoin fraud perpetrated against Eastern European cryptocurrency users, predominantly in Russia and Ukraine.

Fumiko sent most of its more than $1.5 billion worth of cryptocurrency to mainstream exchanges, high-risk exchanges, a hosted wallet service, and a P2P exchange. However, we don’t know what share of those transfers represent payments to victims in order to give the appearance of successful investments.

Most interesting of all though is Finiko’s transaction history with Suex, an OTC broker that was sanctioned by OFAC for its role in laundering funds associated with scams, ransomware attacks, and other forms of cryptocurrency-based crime. Between March and July of 2020, Finiko sent over $9 million worth of Bitcoin to an address that now appears as an identifier on Suex’s entry into the Specially Designated Nationals (SDN) List. This connection underlines the prolificness of Suex as a money laundering service, as well as the crucial role of such services generally in allowing large-scale cybercriminal operations like Finiko to victimize cryptocurrency users.

Soon after Finiko’s collapse in July 2021, Russian authorities arrested Doronin, and later also nabbed Ilgiz Shakirov, one of his key partners in running the Ponzi scheme. Both men remain in custody, and arrest warrants have reportedly been issued for the rest of Finiko’s founding team.

Luno is a leading cryptocurrency platform operating in over 40 countries, with an especially heavy presence in South Africa. In 2020, a major scam targeted South African cryptocurrency users, promising large investment returns. Knowing that its users were at risk, 

The first step was a warning and education campaign. Using in-app messages, help center articles, emails, webinars, social media posts, YouTube videos, and even one-on-one conversations, Luno showed users how to spot the red flags that indicate an investment opportunity is likely a scam and taught them to avoid pitches that appear too good to be true.

Luno then went a step further and began preventing users from sending funds to addresses it knew belonged to scammers. That’s where Chainalysis came in. As the leading blockchain data platform, we have an entire team dedicated to unearthing cryptocurrency scams and tagging their addresses in our compliance products. With that data, Luno was able to halt users’ transfers to scams before they were processed. It was a drastic strategy in many ways. For example, cryptocurrency has historically been built on an ethos of financial freedom, and some users were likely to chafe at a perceived limitation on their ability to transact. But thanks to Chainalysis’ best-in-class cryptocurrency address attributions, Luno established the trust necessary to sell customers on the strategy.

Luno first began blocking scam payments for South African users only in November 2020, then rolled the feature out worldwide in January 2021. The plan worked, and transfers from Luno wallets to scams fell drastically throughout 2021. 

 

The Trades That Triggered UST’s Collapse

The 2022 crypto market downturn began with the collapse of Sam Bankman-Fried and the Terra-Luna ecosystem and its associated stablecoin, TerraUSD (UST). This single event is estimated to have erased as much as $60 billion in market value overnight. In this section, we use blockchain analysis to explain five trades from just two traders:

1. Two traders break UST’s peg. In the first one, where the peg-breaking trades are in green:

On the night of May 7th, Terraform Labs withdrew 150 million UST from 3pool, a decentralized stablecoin exchange, as part of a planned public effort to move these funds to another pool. This made the pool more “shallow,” i.e.prone to volatility.

Thirteen minutes later, one trader – perhaps taking advantage of this vulnerability – swapped 85 million UST for USDC. Over the next hour, another trader then swapped 100 million UST for USDC in increments of 25 million. 

In response, Terraform Labs withdrew another 100 million UST from 3pool. This was intended to “rebalance” the ratio of UST to other stablecoins.

But by this time, these large trades – and the many smaller ones that followed – had broken UST’s peg.

UST-USDC prices on May 7th, 9:00 AM–10:50 PM UTC

Investors panicked, the sell-off began, and many holders with UST deposited in Anchor started withdrawing their funds.

On March 13th, Bybit estimated that “at the current yield reserve of $24.7M UST and a current ratio of deposits and borrowings … [Anchor has] a runway of about ~13 days before yield reserves have completely depleted.” In mid-April, Decrypt reported that more than 72% of all UST was deposited in Anchor – indicating that a significant reason for holding UST may have been to earn Anchor’s yields.

 

A Note On Anchor

Anchor is a DeFi protocol operated by Terraform Labs, the creators of UST. For most of its existence, it has paid 19.5% APY on any quantity of deposited UST. It has then lends these deposits at APRs that typically vary from 2% to 15%. Only about one-half to one-sixth of the deposited UST has been lent out to borrowers at any time.

2. Repairs of the peg are successful but short-lived 

To repair the peg and rebalance 3pool, three unidentified UST supporters swapped a combined $480 million Tether (USDT) for UST on May 7th, 8th, and 9th.

Then, on May 9th, the Luna Foundation Guard (LFG) sold billions of Bitcoin from its reserves to swap for UST.

But by May 10th, LFG’s reserves were depleted, and UST had again lost its peg – this time for good. 

UST-USDC prices on May 7th, 10:50 PM–May 10th, 00:00 AM UTC

In a last ditch effort to stop the sell-off, multiple exchanges suspended withdrawals.

3. The mass minting of LUNA leads to hyperinflation and a crash. 

Meanwhile, UST’s largest liquidity pool was drying up. 3pool’s balance of UST to 3CRV – a “basket” of stablecoins that includes USDC, USDT, and DAI – was fast approaching 95% to 5%, far from the 50% to 50% ideal. 

UST-3pool balance, 5/4/2022–5/14/2022

Only a single value-preserving exit remained. Per the stablecoin’s algorithm, a UST holder could always “burn” one UST to “mint” one dollar worth of LUNA,no matter the price of LUNA.

And so holders burned their UST en masse, hyperinflating LUNA. Its supply entered the trillions; its price fell to fractions of a cent. When LUNA’s market cap dipped below UST’s, it became clear that not everyone could burn UST wfor equal value.

UST vs. LUNA market cap, 5/1/2022–6/2/2022

The remaining holders sold at lower and lower prices until UST was worth little more than a penny. The algorithmic stablecoin had collapsed. 

UST-USDC prices on May 10th, 00:00 AM–June 2nd UTC

 

Undercollateralized, Overcollateralized, And Fiat-Backed Stablecoins

Unlike most stablecoins, UST was algorithmic and undercollateralized. Rather than maintaining its peg by holding assets in reserves, Terraform Labs used a sister token, LUNA, to “absorb the price volatility of UST.” 

Other stablecoins are crypto-backed and overcollateralized, like DAI. Borrowers must deposit $1.50 worth of ETH for every DAI they wish to borrow. Still, others are fiat-backed and collateralized one-to-one, like USDC. Its reserves are held in cash and short-dated government treasuries. 

Stablecoins vary in their utility as well. The algorithmic UST and the crypto-backed DAI serve DeFi, but fiat-backed stablecoins have other use cases. They can help exchanges settle trades, migrants send remittances, and citizens of high-inflation countries store value. Tether recently launched a peso-backed stablecoin to facilitate remittances to and from Mexico, for example, and stablecoins are quite popular among inflation-weary Argentines.

Only a single value-preserving exit remained. Per the stablecoin’s algorithm, a UST holder could always “burn” one UST to “mint” one dollar worth of LUNA, no matter the price of LUNA. 

And so holders burned their UST en masse, hyperinflating LUNA. Its supply entered the trillions; its price fell to fractions of a cent. When LUNA’s market cap dipped below UST’s, it became clear that not everyone could burn UST wfor equal value. 

                                         UST vs. LUNA market cap, 5/1/2022–6/2/2022

The remaining holders sold at lower and lower prices until UST was worth little more than a penny. The algorithmic stablecoin had collapsed. 

UST-USDC prices on May 10th, 00:00 AM–June 2nd UTC

 

What Were The Macroeconomic Impacts Of The Collapse?

UST and LUNA’s collapse didn’t happen in a vacuum. At the same time, several other crypto assets, including Bitcoin, also declined in what some have said may be the beginning of a third crypto winter.

But was the UST’s collapse to blame for that decline? While it was a factor, we find that because Bitcoin’s decline was so closely aligned with the

the downturn of non-crypto assets — especially tech stocks — its price action may. have been more connected to the tech slump than UST’s crash.

Bitcoin’s correlation with tech stocks is a relatively new development. The graph below shows the correlation between Bitcoin’s price and that of several other asset classes in 2017.

Bitcoin correlations with NDXT, SPY, and GLD in 2017

 

While there were “waves” of correlation, that is typical of assets with no significant relationship. This pattern bolstered the narrative that Bitcoin was uncorrelated and a haven during market declines.

The collapse of UST may have accelerated Bitcoin’s decline. This was expected — LFG sold billions worth of Bitcoin to repair the peg — but also short-lived. The accelerated deterioration ended around May 13 at roughly the close of UST’s collapse, at which point Bitcoin’s price action fell back in line with non-crypto tech assets. 

One can also observe a spike in stablecoin sales during UST’s collapse. From May 9th to 12th, hundreds of billions more stablecoins than usual were sold for cash. 

Daily stablecoin volume on services, 4/28/2022–5/18/2022

 

All kinds of investors sold their stablecoins during the crash, from big institutional players to retail investors.

The daily stablecoin value transferred to services by transaction size, 5/1/22– 5/16/22

Redemptions peaked across all stablecoins — algorithmic and asset-backed. 

This suggests that the collapse scared many investors away from stablecoins altogether, not just those of a certain class. 

The daily stablecoin value transferred to services by stablecoin type, 5/8/22– 6/6/22

Nonetheless, significant stablecoins weathered the storm. Though Tether briefly fell by 3¢ on May 12, it quickly rebounded and processed over $13 billion in USDT redemptions over a week-long stretch. 

 

Part One, Part Two, Part Three, Part Four

 

 

For updates click hompage here