FTT Whale Tracking during the FTX Bankruptcy
In the aftermath of the FTX bankruptcy, many teams of attorneys and accountants will need to pore over records to see what assets flowed where and to trace their current owners. While this may be a very difficult task in many cases, where the assets are held on the blockchain, a complete record of all transactions is there for all to see.
This article is written to document the author’s experiences in tracking down movements in the so called “FTT Coin” from just before the FTX bankruptcy until a point 2 months later.
The FTT coin
The FTT coin is implemented according to the ERC-20 standard and in this way it is like so many coins that have been launched on the Ethereum Network automatically allowing most popular wallet software (e.g Metamask) to be used to move coins from one owner to another.
The coin was issued as part of a so-called Initial Exchange Offering process undertaken by the FTX exchange itself on July 29th, 2019 raising around $10m in the process which FTX would use for development, marketing and business operations. It was intended to be a utility token that traders on the exchange could earn by engaging in certain activities and it would also afford trading discounts to its holders.
The ERC-20 contract for FTT is present on the Ethereum Blockchain at address: 0x50D1c9771902476076eCFc8B2A83Ad6b9355a4c9 and anyone can inspect it using the most common Ethereum Blockchain Explorer (Etherscan) using this link. Looking at the code on Etherscan, it is apparent that at creation time, 350,000,000 FTT coins were minted. The contract allows for coins to be ‘burnt’. An owner of coins can simply request the contract to ‘burn’ X coins and they will simply be subtracted from their balance and cease to exist. This has happened a number of times and at the time of writing (January 2023), the total number of FTT remaining is given as 328,895,112
Exploring the Ownership of the Coin
Any ERC-20 coin contains within its contract on the Blockchain a Balances table. This table can be thought of as a ledger with just two columns — the address of the owner and the number of coins assigned to that owner. So balances[User1] might be equal to 250 and balances[User2] might be 23. If User1 chooses to send 7 FTT to User2 — the code of the contract simply updates these balances to 243 and 30 and the transfer is complete.
All of the balances and every transaction ever invoked on the Blockchain is recorded for ever in the Blockchain state and can be inspected by anyone with the right software tools.
Basic Exploration using Etherscan
The most popular Blockchain explorer Etherscan is great for inspecting Blockchain state. So we can type in the FTT Contact Address (0x50D1c9771902476076eCFc8B2A83Ad6b9355a4c9) and immediately get the top 1,000 holders of the coin ranked in order of the size of their holding. This will be accurate for the moment when the link is selected
This is interesting and instantly we get the picture that more than 59% of the outstanding coins are in the hands of a single owner. A lot of the time though, Etherscan is not able to identify who that is, beyond giving us their Blockchain Address (0x2a4f8d77bade18256b1bdb3cf8782645037f60d3 in this case). We can click on the address though and find all of its coin holdings as well as view all recent transactions entered into. This may give us an insight into at least what type of entity is behind the address.
Alternatively a Google search might take us to other blockchain explorer sites and lead us to believe that this address was in the control of (say) the Securities Commission of the Bahamas, but it is often difficult to be sure.
Attribution is critical in interpreting Blockchain data and while some entities like Binance have, in the interests of transparency, revealed a list of the addresses they use, this has not been normal practice.
Etherscan does keep a list of so-called “Public Name Tags” like the BITDAO:Treasury shown in the table above. They only do this though when a user comes forward, asserts ownership of the address and requests to be added to the table.
Given that Etherscan does not have a label for the current top holder of the FTT token, but we suspect that it might be connected with the Securities Commission of the Bahamas, we can click on that address in Etherscan and view all the transactions that account has undertaken.
We can see that the first transactions on the account took place on November 13th with a test send of 1 token followed by a transfer of 195,869,335 FTT tokens with not a lot of significant activity thereafter. This is consistent with our suspicions on who the account belongs to.
Exploring the Blockchain State at Different Points in Time
Etherscan is very good for capturing the state of the blockchain at the present moment in time and is also quite good at showing us transaction history. If we want to be more specific about what we want to look at and over what precise period, we need a more flexible blockchain analysis tool that also requires some rudimentary coding skills.
Dynamic Blockchain Analysis using Dune Analytics
While the blockchain state is held by every fully operational Blockchain nodes, and there are over 8,000 of these scattered across the globe, the data is not stored in a form that is easy to query.
Specific nodes capture the state of the blockchain as each block is created and upload it to Dune Analytics where the raw data is stored in a conventional relational database. Once there, the raw data undergoes processing to produce a variety of summary tables that contain useful sub-sets of that data.
Dune Analytics allows its registered users to compose arbitrary queries on the database in the well known Structured Query Language (SQL).
For example, one of the derived tables captures the “Transfer” events emitted by each ERC-20 contract whenever a Transaction causes an amount of tokens to be transferred from one user to another. Because these are now stored in a conventional database, we can now formulate a query like the one below:
This selects all fields of each transfer of FTT between the specified dates. This turns out to be quite a large number (99,979) so a bit more refinement is needed in the query before there is any point in a human inspecting the results. SQL is a very powerful language and individual columns can be SELECTed, summarized by SUMming or COUNTing them as well as JOINing tables together based on common field values.
Tracking the FTT Whales
SELECTing all transactions up to 1st November, 2022 — just before the FTX Bankruptcy was declared — summing those movements and ordering by size allows us to produce the top 10 holders of FTT on that date. These 10 users account for more than 93% of the outstanding coin, so they surely qualify as Whale users.
Top 10 FTT Holders on November 1st, 2022 (pre-bankruptcy filing)
It looks as though 59% of the coins are in the hands of an entity registered with Etherscan as FTX deployer and this is likely the master treasury of coins held by FTX.
Fast forward to around 2 months later in January 2023 when most of the drama around the bankruptcy filing has subsided and the new table of top 10 holders looks like this:
It looks like some FTT holders have remained unmoved by the bankruptcy with the unknown-4aa8 address and the BitDAO Treasury holding the same before as after. The account that we believe is associated with the Wormhole Portal Token Bridge has also barely changed.
All the coins in the hands of the FTX deployer have been captured by a new address (2a4f..) that some internet sources suggest is the Securitites Commission of the Bahamas.
The new Multisignature Account (97f9..), which when inspected, is found to hold a large quantity of a very big range of coins along with the FTT has a holding that is of comparable size to the one labelled FTX Exchange in the pre-bankruptcy scenario. It seems likely that this is an account controlled by the US liquidator who has captured most of the FTT assets in the FTX exchange account.
The movements among the Binance accounts are a bit more difficult to explain. Pre-Bankruptcy, the Binance 35 account held 23m FTT Tokens. After the bankruptcy, the collective Binance accounts (8, 14 and 16) held 43m tokens. Only Binance would know how much of these funds are held on behalf of itself and how much is held on behalf of Binance customers.
Cross-Checking Against Whale Transactions
As a check on movements, we can also SELECT the 10 largest (whale) transactions that took place during out inspection period.
This confirms most of what we deduced above. We can see that on November 12th, the FTX exchange transfers its balance briefly to the unknown-d801 account and 45 minutes later the full amount is forwarded onwards to its final destination.
We can also see that on 13th November, the entire contents of the FTX deployer account is moved to an account that we believe is operated on behalf of the Securities Commission of the Bahamas.
The remaining Whale transactions involve shuffling large balances around among accounts controlled by Binance. Since Binance is a centralized entity that acts of behalf of many other parties, only they can explain what the purpose and effect of these are in terms of FTT ownership.
Reflections on Blockchain Transparency
Just to round off this short article, we have seen that the Blockchain is far more transparent to the ordinary citizen than any other system out there handling financial transactions. Technically, the Blockchain records everything that happens, creates detailed logs that are impossible to destroy or alter and allows anyone to access them.
In practice though, a major problem is address attribution. Blockchain addresses can be created very easily. If a user is using a so-called Hierarchical Deterministic Wallet (and most are) then it is entirely possible to create thousands of different addresses all derived from a single seed phrase and therefore quite easily managed. Tying an individual reliably to an address is quite hard to do.
Gaining a big-picture of what is happening can be difficult because the traffic of interest is immersed in a large sea of other transactions in a system that runs 24/7/365. The problem becomes much more tractable if one knows what one is looking for. Armed with the key addresses and a definite time-frame, it is relatively easy to build up a fully picture of what transactions were made, when and by who. In such circumstances, gathering the evidence of a financial mis-deed is straightforward and it can be depended on.
We have not uncovered anything terribly surprising about the movements of FTT before and immediatly after FTX filed for bankruptcy. In big picture terms, most of the coin was owned by FTX before the bankruptcy and the bulk of that is now in the hands of the bankruptcy administrators of the US and the Bahamas. As far as future prospects for the coin, with 75% of the outstanding coin in the hands of liquidators, the future is not bright.
