FTX's collapse. About 80,000 transactions were left in "Ask My Accountant"

The report says major authority across the FTX Group was concentrated among Sam Bankman-Fried, Nishad Singh and Gary Wang, with little delegation.

One FTX Group executive described the company’s dependence on Singh and Wang for technology development and architecture in unusually direct terms.

The executive told the investigation: “if Nishad [Singh] got hit by a bus, the whole company would be done. Same issue with Gary [Wang].”

The same page says the President of FTX.US raised concerns about delegation, management structure and hiring, after which his bonus was drastically reduced and senior internal counsel instructed him to apologize to Bankman-Fried. He refused. The report also describes another lawyer being terminated after raising concerns about Alameda’s controls, capable leadership and risk management.

According to the report, in late December 2020, the FTX Group learned, while exploring a potential direct listing on NASDAQ, that FTX.US would have to be audited. The audit would include a review of policies and procedures, so management needed documents to show the auditors.

Management asked employees familiar with parts of the workflow to provide first drafts of policies and procedures in just 24 hours.

According to the report, the resulting documents were prepared by editing off-the-shelf precedents supplied by outside accountants. It was unclear how closely they reflected the real business, and they were never formally promulgated or used to train employees.

The report says 56 FTX Group entities did not produce financial statements of any kind. Thirty-five used QuickBooks, while also relying on a mixture of Google Docs, Slack, shared drives and Excel to track assets and liabilities.

Crypto records could be similarly generic. Some entries recorded “investments in cryptocurrency” without identifying the asset or quantity, making reconciliation with other sources difficult or impossible.

Approximately 80,000 transactions were left as unprocessed accounting entries in catch-all QuickBooks accounts titled “Ask My Accountant.”

The report says these practices made it extremely difficult to reconcile transactions and understand the Group’s financial position.

Alameda Research’s recordkeeping was also poor enough, the report says, that it was difficult to determine how positions had been valued.

A June 2022 “Portfolio summary” contained a note about valuation inputs for certain tokens.

The instruction read: “come up with some numbers? idk.”

In another internal communication, Bankman-Fried described Alameda as “unauditable.” He wrote that its balances could only be ballparked, let alone a comprehensive transaction history, and that the company sometimes found $50 million of assets it had lost track of.

The report says important documents such as executed loan agreements, intercompany agreements, acquisition and investment documents, and bank and brokerage statements were often incomplete, contradictory or missing.

After the bankruptcy filing, the new team collected undeposited checks from FTX Group offices.

Thousands of checks had gone undeposited, some stale-dated for months, because personnel had failed to deposit them in the ordinary course. The report says they accumulated “like junk mail.”

The same section says the Group also lacked reliable lists of bank and trading accounts, crypto wallets and authorized signatories, forcing the restructuring team to reconstruct historical information from scratch.

The FTX Group frequently relied on Slack, Signal and other informal channels to document approvals. Signal and Telegram were at times used with disappearing messages enabled for communications with both internal and external parties.

Expenses and invoices were submitted on Slack and approved by “emoji.”

The report continues that informal and ephemeral messaging systems were also used to obtain approvals for transfers in the tens of millions of dollars, leaving only informal records or no records at all.

It does not say that those large transfers were necessarily approved by emoji specifically; the emoji example is stated for expenses and invoices.

The FTX Group also maintained a large number of accounts on external digital-asset trading platforms around the world, some of which held significant assets at different times.

It had more than a thousand external-platform accounts, but no comprehensive centralized source listing each account’s purpose or credentials.

Many were opened under names and email addresses that were not obviously connected to FTX, including pseudonymous email addresses, shell companies and individuals. The report says some accounts were even in the names of people with no direct connection to FTX.

According to the report, FTX.com’s customer database included a “borrow” setting defining how far an account balance could become net-negative without triggering trade restrictions or automatic liquidation.

As of the bankruptcy petition date, most retail customers had a borrow value of zero. Certain preferred customers and market makers had positive values, but those went only as high as $150 million.

Alameda alone had a borrow value set to $65 billion.

This was a database setting on the petition date, rather than an amount actually borrowed. Inadequate logs prevented the Debtors from determining precisely when or by whom the $65 billion setting had been configured.

Alameda also had a “can_withdraw_below_borrow” privilege that appears to have been superseded by “allow_negative.” The report says allow_negative permitted unlimited crypto withdrawals while net-negative and exempted the account from automatic liquidation. On the petition date, Alameda was the only FTX.com customer with allow_negative set to true.

Multi-signature or multi-party controls are intended to prevent one person or one compromised location from being enough to move crypto assets.

The report says the FTX Group made only limited attempts to use such controls, and misapplied them when it did.

For some wallets, all three private keys required to authorize a transfer were stored together in one place, defeating the purpose of the control.

Alameda’s key documentation could be equally weak. A key for $600 million of crypto assets had a title consisting of four non-descriptive words and no information about its purpose or who might have relevant information about it. Other keys worth millions were simply titled “use this” or “do not use.” The Debtors also identified private keys to more than $100 million in Ethereum assets stored in plaintext and unencrypted on an FTX Group server.

The FTX Group recommended that customers use multi-factor authentication. Bankman-Fried also publicly emphasized two-factor authentication as a basic crypto-security practice.

Internally, however, the Group did not enforce MFA for two critical services: Google Workspace and 1Password.

The report calls the gap ironic. One of Bankman-Fried’s public posts read: “Daily reminder: use 2FA! 90% of crypto security is making sure you’ve done the basics.”

The report also says that even where an important corporate email account had MFA, management arranged a way to bypass it.

In November 2022, suspicious transfers occurred from FTX Group crypto wallets. The report refers to this as the “November 2022 Breach.”

The Group lacked a prompt mechanism to detect access to private keys for central wallets, and basic AWS threat-detection features were not fully enabled.

FTX Group learned of the breach only after a restructuring adviser saw suspicious wallet transfers via Twitter and other public sources and alerted employees.

The report also says there was no basic mechanism to alert the company to a “root” login to its AWS account.