Inside SBF's $250K Scheme to Bring Down Tether
Was Sam Bankman-Fried trying to cause Tether's downfall in FTX's final days? Or was it all an innocent misunderstanding?
The New York Times dropped a juicy story on Friday that gives us an inside view to the drama in the days leading to FTX’s bankruptcy. Titled “Inside the Frantic Texts Exchanged by Crypto Executives as FTX Collapsed”, the article contains messages from a Signal group chat including Sam Bankman-Fried (FTX’s then-CEO), Changpeng Zhao (Binance’s CEO, commonly referred to as CZ), Jesse Powell (Kraken’s founder), and Paolo Ardoino (Tether’s CTO), among others.
The subject of those chats: a $250,000 trade made by FTX/Alameda that CZ feared was intended to depeg Tether (also known as USDT), or at least profit if it did. For those unfamiliar with Tether, we refer you again to @patio11’s excellent primer. Suffice it it say that Tether is crypto’s largest stablecoin with a market capitalization of roughly $65B, that many believe it is not sufficiently capitalized, and that the impact of its collapse on the crypto ecosystem would make FTX’s implosion look like a minor hiccup.
The Wall Street Journal followed the NYT with an article of their own that detailed the same group chat interaction. That article included the name of the group chat: “Exchange coordination.” This name will surely not assuage anyone who thinks crypto is rigged against retail investors, and also brings to mind a memorable scene from The Wire about the wisdom of putting certain actions into writing, regardless of end-to-end encryption.
We reproduced the Signal messages reported by the NYT/WSJ from SBF’s perspective, with only slight liberties taken:
The NYT article does not really describe the trade being discussed, although it does include a denial from SBF: “Trades of that size would not make a material impact on Tether’s pricing, and to my knowledge neither myself nor Alameda has ever attempted to intentionally depeg Tether or any other stablecoins.”
The WSJ goes into a bit more detail:
Public blockchain data show Alameda borrowed more than 1 million tether, also known as USDT, from crypto lending platform Aave across several transactions on Nov. 10, including one transaction for 250,000 tether that caught traders’ attention on social media. The hedge fund appeared to swap some of that tether for rival stablecoin USDC, sparking concerns that Alameda was trying to drive down tether’s value.
The WSJ cited “a person close to Alameda” as saying that “the tether trades were aimed at closing down positions and returning money to lenders.”
So who’s telling the truth? Were Alameda’s trades as innocent as SBF would have us believe, or was CZ right to suspect that SBF was trying to bring down Tether?
The NYT gives a hint about where we might look for an answer: “The trade was visible on the blockchain, a public ledger of cryptocurrency transactions that anyone can view.” Wait, anyone? Even, perhaps, the writer of a crypto-skeptical Substack with way too much time on their hands?
Indeed, dear reader. To the blockchain: let’s dive in.
We Spent Weeks Searching for The Trades
Just kidding! A quick Google search turned up this tweet:
Which itself links to the tweet that we suspect got CZ in such a tizzy:
This tweet references a transaction between an Ethereum wallet with address 0x5d13f4BF21dB713e17E04d711e0bf7Eaf18540d6 and 3pool on Curve:
That wallet is labeled as Alameda Research 9 on Etherscan; it’s included in Larry Cermak’s list of known Alameda addresses. The trade certainly seems to match the description in the NYT/WSJ articles: 250K USDT being swapped for 250K USDC, in a potential effort to imbalance 3pool.
To understand the fuller context of this trade, we took a look at the transactions from the same wallet in the surrounding days. This analysis doesn’t paint a complete picture of what SBF and co. were up to, of course; this is one wallet among many that Alameda controlled, and there’s a limit to what on-chain data can tell us. But these transactions should hopefully give us a hint about Alameda’s motivations in the hours leading up to bankruptcy.
The Trades in Question
The first thing to understand about this wallet is that, while it had been used between August and mid-October, it had been dormant for nearly a month prior to the USDT trades on Nov. 9-11:
As best we can tell, it did not hold any USDC or USDT prior to the trades on Nov. 9.
A full list of the relevant trades is in this spreadsheet we put together. That spreadsheet contains information about the transactions and the wallet’s USDC/USDT balances after each one. Let’s take a look.
USDC Transfered In
Between Nov. 9 at 5:30 a.m. (all times are in UTC) and Nov. 10 at 7 a.m., 9.4 million USDC were transferred into the wallet from Binance, crypto.com, and other wallets. 300K USDC was also transferred to another wallet (0x23563b191c34806d68b7af46bad29ef775cfccd9), which will ultimately receive all of the remaining USDC at the end of these trades.
Let the Swaps Begin
This is when the action begins. Between 9:05 a.m. and 12:44 p.m. on Nov. 10, the Alameda wallet conducted three groups of transactions. The details vary for each group, but at a high level they consisted of three components:
USDC Deposit on Aave: First, the wallet would deposit USDC collateral (ranging from 300K to 1.25 million) on Aave, a decentralized crypto lending platform.
USDT Loan from Aave: Then the wallet would borrow USDT from Aave, collateralized by the USDC.
USDT/USDC Swap: Lastly, the wallet would swap that USDT for USDC via a series of decentralized finance protocols. As in the case of the 250K transaction above, this could be as simple as depositing USDT into 3pool and pulling out USDC. In some cases this trade involved a dizzying array of intermediaries:
Note that the trade above seems to be orchestrated by 1inch, which aggregates defi protocols1.
Following these three borrows/swaps, whoever was doing these trades borrowed another 50K USDT from Aave without depositing more collateral (I’m guessing they realized they had additional borrowing capacity) and swapped it for USDC.
At the beginning of these trades, Alameda’s wallet had 9.4M USDC. When all was said and done, their wallet held 9.03M USDC. They also had 2.15M USDC collateral on Aave and a 1.8M USDT loan from Aave.
The Great Unwinding
About 15 hours later, at 2:50 a.m. on Nov. 11, the wallet started closing out the Aave loans and transferring tokens out. First, the wallet transferred just over 1 million USDC to the wallet we mentioned earlier, 0x23563b191c34806d68b7af46bad29ef775cfccd9, which will receive all of the funds in the Alameda 9 wallet.
Then, the main Alameda wallet swapped 1.8M USDC for USDT via 3pool and another defi protocol called Balancer. It used the USDT it received to repay its USDT loan on Aave and pulled out its 2.1 million USDC collateral from Aave. Lastly, over the course of four transactions, it transferred the remaining USDC, about 8.4 million, it held out to the 0x235 wallet.
Approximately five and a half hours after these transactions were completed, SBF resigned as CEO of FTX and handed his companies over to professionals who commenced Chapter 11 proceedings.2
Wait But Why?
So what to make of this strange flurry of transactions? Let’s consider a few explanations, starting with the most benign.
Nothing to See Here, Folks!
Maybe the Alameda insider who talked to the WSJ was telling the truth: these transactions had no sinister motivation, but were simply part of an effort to close out some of Alameda’s existing positions before handing everything over to the grown-ups. Responsible — and considerate.
Maybe! We don’t consider ourselves to be defi experts and perhaps these transactions need to be considered along with transactions from some other wallets. But no matter which way we look at these trades, we have a hard time seeing anything being closed out. Indeed, at a high level, these trades transferred a bunch of USDC in, shifted USDC/USDT liquidity around a couple defi protocols for a little under a day, and then transferred that USDC out.
SBF Was Sabotaging Tether
Maybe CZ’s fears were founded! There are two effects we can infer from the USDT/USDC loans and swaps. First, Alameda had a USDT-denominated loan on Aave that was collateralized by USDC. So they stood to profit if USDT’s value declined relative to USDC, regardless of whether they actually intended to cause that decline themselves.
Secondly, by borrowing from Aave and swapping via 3pool/Balancer, Alameda was shifting liquidity around defi protocols. Maybe they thought these transactions would cause an imbalance on one of those protocols and spook the market’s confidence in Tether.
The case against this argument is primarily based on size. If SBF really wanted to bring down Tether, the thinking goes, he’d put a lot more than $2M behind that trade. And it would be foolish, even for the likes of those running FTX and Alameda, to think that a trade of this size would destabilize a stablecoin that does tens of billions of trading volume per day.
Our Theory of the Case
Never attribute to malice that can be explained by incompetence, the saying goes. And competence was never FTX/Alameda’s strongest suit at the best of times, it turns out, and likely even less so in the frenzy between the collapse of FTX and the filing of its bankruptcy petition. So regardless of the answer to this mystery, we’re hesitant to ascribe too much import to these trades.
They do look like they were structured to at least benefit from a fall in value of USDT though. Why they only put on a $2M trade, we’re not sure. Could SBF have been scrambling for ideas, started to put on a Tether short, and then shut it down after CZ called him out? And how nefarious this all was, it’s hard to say. Perhaps these trades were intended to offset long exposure to USDT elsewhere that we’re not seeing by looking at a single wallet.
Enter Paolo
What’s more interesting to us is a throwaway line from the WSJ article. CZ’s messages may have gotten the most attention, but the WSJ also noted the actions of another member of the chat: “On Nov. 10, [Paolo] Ardoino, [Tether’s CTO] had already expressed concerns that Alameda was trying to push down the price of tether and drag other cryptocurrencies with it, according to one of the people.”
It seems like it was in fact Tether’s CTO who first brought Alameda’s USDT trades to the attention of the “exchange coordination” chat.
Now why would the CTO of an institution with $65 billion in assets be worried about a few minuscule trades involving their stablecoin? USDT is fully backed, Tether has never refused any redemptions, everything is good, everything is fine, really. Did we mention that Tether is fully backed?
Perhaps that CTO was scrolling through Twitter on Nov. 10, and saw the tweets we linked above. And perhaps that CTO was also thinking about other popular tweets from the past day, like this one:
Or maybe this one:
That CTO might have understand that if Tether isn’t actually backed, what matters in this situation isn’t whether FTX/Alameda is actually trying to bring Tether down or not. It’s whether people think that might be the case. Because, rightly or wrongly, if people get spooked, they might actually demand to see what’s inside that black box of Tether’s. And they might not like what they find.
1inch also received a $10M investment from the venture arm of none other than Alameda Ventures. Although if you were a defi protocol operating in the last two years and you didn’t receive a $10M investment from Alameda, what were you doing, exactly?
John J. Ray III’s first day declaration put the time of SBF’s surrender at 4:30 a.m. EST on Nov. 11.