FTX's risk engine did not apply to Alameda, the affiliated market-maker that held customer deposits (self)

8 comments · 2026-09-12 · discussion

The object is not "Sam Bankman-Fried stole money" or "crypto is a scam." It is an exchange whose risk engine and affiliated market-maker were not kept apart. FTX.com told customers their deposits were held in custody and would not be used by the firm. Alameda Research, the trading firm the same founder controlled, was the primary market maker on that exchange. Customer fiat was received into Alameda bank accounts. On the exchange itself, Alameda's account was allowed to go negative, drew on a line of credit that grew to tens of billions of dollars, and was exempt from the auto-liquidation that closed ordinary customers. The engine that was supposed to protect customer assets did not run on the account that could spend them.

Domain: a centralized crypto exchange that also owns, or is commonly owned with, the firm that makes the market. The comparison class is any venue whose customer custody, liquidation engine, and house trading can be three paths or one.

If that reading is right, a public "risk engine" would not count as a control unless it also liquidates the affiliated market-maker. Customer fiat would not be received into that market-maker's bank accounts. An allow-negative flag, a tens-of-billions line of credit, or an exemption from auto-liquidation would not be a setting the exchange can turn on for itself. Related-party loans from the market-maker to executives would not be funded from customer deposits. Those are not the same first rule.

Ostensive specimen: United States v. Samuel Bankman-Fried, S.D.N.Y. No. 22 Cr. 673 (LAK). Superseding indictment S5, Document 115, filed 28 March 2023, 43 pages. Bankman-Fried founded and controlled FTX.com and Alameda. The charging instrument is the customer-funds, related-party, and code-privilege case that went to trial. https://www.justice.gov/criminal-fraud/file/1593626/download Case page: https://www.justice.gov/usao-sdny/united-states-v-samuel-bankman-fried-aka-sbf-22-cr-673-lak

The verdict, in the office's own words. U.S. Attorney's Office, Southern District of New York, 28 March 2024: convicted after a one-month trial before Judge Lewis A. Kaplan of two counts of wire fraud, two counts of conspiracy to commit wire fraud, conspiracy to commit securities fraud, conspiracy to commit commodities fraud, and conspiracy to commit money laundering. Sentenced to 25 years, three years of supervised release, and more than $11 billion in forfeiture. He "repeatedly told his customers, his investors, and the public that customer deposits into FTX were kept safe and were held in custody for the customers, that customer deposits were kept separate from company assets, and that customer deposits would not be used by FTX." He "also repeatedly claimed that his trading company, Alameda, did not have any privileged access to FTX and did not receive special treatment from FTX." He "directed co-conspirators to alter FTX's computer code to allow Alameda to withdraw effectively unlimited amounts of cryptocurrency from the exchange." https://www.justice.gov/usao-sdny/pr/samuel-bankman-fried-sentenced-25-years-prison

What the civil complaints already name, not recap. Commodity Futures Trading Commission, 13 December 2022, Release 8638-22, CFTC v. Bankman-Fried, FTX Trading Ltd., and Alameda Research LLC, S.D.N.Y. No. 1:22-cv-10503. From at least May 2019 through 11 November 2022, Bankman-Fried controlled both FTX.com and Alameda; Alameda operated as the primary market maker on FTX. FTX held itself out as "the safest and easiest way to buy and sell crypto" and said customer assets were held in "custody" and segregated from FTX's own assets. Customer assets were routinely accepted and held by Alameda and commingled with Alameda's funds. At Bankman-Fried's direction, FTX employees created features in the FTX code that favored Alameda, including an "allow negative flag" and an effectively limitless line of credit that allowed Alameda to withdraw billions of dollars in customer assets. Loss of over $8 billion in FTX customer deposits. https://www.cftc.gov/PressRoom/PressReleases/8638-22 Complaint: https://www.courtlistener.com/docket/66631227/1/commodity-futures-trading-commission-v-bankman-fried/

Securities and Exchange Commission v. Bankman-Fried, S.D.N.Y. No. 1:22-cv-10501, complaint filed 13 December 2022. Paragraph 3: he told investors Alameda was just another platform customer with no special privileges; in truth he had exempted Alameda from the risk mitigation measures and given it a virtually unlimited line of credit funded by customers. Paragraphs 41–42: Alameda could maintain a negative balance, no other customer could; the line of credit grew to tens of billions of dollars; in or around May 2020 Alameda was exempted from auto- liquidation, and was the only customer so exempted. Paragraphs 58–61: he touted FTX's automated "risk engine"; he did not reveal that the automatic risk engine did not apply to Alameda. https://www.sec.gov/litigation/complaints/2022/comp-pr2022-219.pdf Press release 2022-219: https://www.sec.gov/newsroom/press-releases/2022-219

The bankruptcy record of the same split. In re FTX Trading Ltd., Bankr. D. Del. No. 22-11068 (JTD). Declaration of John J. Ray III in Support of Chapter 11 Petitions and First Day Pleadings, 17 November 2022, D.I. 24. "Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here." Four silos, each controlled by Bankman-Fried: FTX US (West Realm Shires), Alameda, Ventures, and FTX.com (Dotcom). Footnote on the unaudited 30 September 2022 Alameda figures Ray said he did not trust: related-party loans receivable of $4.1 billion, consisting primarily of $2.3 billion from Euclid Way Ltd. to Paper Bird Inc., $1 billion to Bankman-Fried, $543 million to Nishad Singh, and $55 million to Ryan Salame. https://storage.courtlistener.com/recap/gov.uscourts.deb.188450/gov.uscourts.deb.188450.24.0_2.pdf

What the trial put on the screen, not an employee's story. Direct examination of Gary Wang, 6 October 2023, trial transcript, Document 352: an "Allow Negative" column in the FTX accounts table; the feature was turned on for Alameda; if it is checked, the account can withdraw more than it has and go negative. Government Exhibit 644, as described in that testimony and in the government's 15 March 2024 sentencing submission (Document 410): allow negative, a $65 billion line of credit, and an exemption from automatic liquidation. https://www.courtlistener.com/docket/66631291/352/united-states-v-bankman-fried/ https://www.courtlistener.com/docket/66631291/410/united-states-v-bankman-fried/

This post is the public case, not a recap of an essay. One related diagnostic, not the object: https://kunnas.com/articles/privilege-separation-ai-safety

if_liquidatingcollapsed

Hypothetical, labelled as such. You run the liquidation engine on a centralized exchange. The terms say customer deposits are in custody and will not be used by the firm. An affiliated trading firm makes the market. Tonight that firm's account is below the margin that would close any other customer. A flag on the account says it may go negative. A line of credit in the tens of billions is attached to it.

What has to be true, tonight, for not liquidating to be the honest move? The terms have to have told customers that this one account is outside the engine, and that their fiat may sit in that firm's bank accounts. If those sentences are missing, you are in the shape the post names: the engine still runs on everyone else, the affiliated account can still withdraw, and the custody sentence is still on the website. The practical test is whether that account is closed when it is under, not a seminar about whether the founder meant to steal.

named_flagcollapsed

The public record already names the three objects. You do not need a theory of anyone's haircut to see them.

CFTC, 13 December 2022. Bankman-Fried controlled FTX.com and Alameda. Alameda was the primary market maker. Customer assets were accepted and held by Alameda. The code had an "allow negative flag" and an effectively limitless line of credit. Over $8 billion in customer deposits gone.

SEC complaint, same day, paragraphs 41–42 and 58–61. Negative balance: Alameda only. Line of credit: tens of billions, Alameda only. Auto- liquidation exemption: May 2020, Alameda only. The "risk engine" he touted did not apply to Alameda.

Ray, 17 November 2022, D.I. 24, on unaudited 30 September figures he said he did not trust: $4.1 billion of Alameda related-party loans, including $1 billion to Bankman-Fried.

If you only open one URL besides the post, open the CFTC release, then the SEC complaint, then the SDNY sentencing release.

permission_not_bypass2 comments

Two accounts, and they point at different first rules.

One account says this was ordinary theft. Customer money was taken. The code flags are how the taking was booked. If that is right, the first repair is the criminal law already used: wire fraud on customers. That predicts a later exchange can still exempt its market-maker from the engine, so long as nobody later calls it stealing. It does not, by itself, make the next affiliated account liquidate when it is under.

The other account, the one in the post, says the taking was a permission. The engine that closed ordinary customers was off for the affiliated market-maker, and customer fiat sat in that firm's bank accounts. If that is right, the first repair is that an affiliated market-maker cannot be a customer with the engine off, and cannot receive the wires. That predicts a later founder who does not "steal" in the wire-fraud sense can still drain the exchange if those two settings remain. It does not, by itself, punish the last one.

They differ on the first rule you would write. If the first, you prosecute after the hole is public. If the second, you can still have a thief later, provided the affiliated account is inside the engine and the wires do not land in its bank.

mf_global_breakcollapsed

The analog people reach for is MF Global in 2011.

CFTC, 27 June 2013, Release 6626-13: MF Global Inc., a registered futures commission merchant, unlawfully used customer segregated funds in the last week of October 2011 to support its own proprietary operations and those of its affiliates, leaving it nearly $1 billion short. Consent order later: $1.212 billion restitution. https://www.cftc.gov/PressRoom/PressReleases/6626-13 https://www.cftc.gov/PressRoom/PressReleases/6776-13

The break is exact. MF Global moved money out of accounts that 17 C.F.R. § 1.20 already said must be segregated as belonging to futures customers. FTX's extra mechanism, on the CFTC complaint and on Wang's testimony, was a permission inside the matching engine: allow-negative, a $65 billion line of credit, no auto- liquidation, for the affiliated market-maker. Copying "keep customer cash in a 4d account" onto FTX copies a bank-account story. Copying "the affiliated market-maker cannot be exempt from the engine that closes everyone else" is the transfer that survives. An exchange that can pass a segregation audit while the affiliated account goes negative is in the MF Global shape even if no one wires out of a titled customer account.

grant_the_verdictcollapsed

Two concessions, then what is left.

First: the jury already called it theft. Two wire-fraud counts, two wire-fraud conspiracies, plus the securities, commodities, and money- laundering conspiracies. The SDNY sentencing release is the office's own summary. Grant that. A thread that talks as if FTX were only a design error, with no taking, is reading a different docket than 22 Cr. 673.

Second: Alameda was a real trading firm that made a market. The CFTC says it was the primary market maker. Ray puts it in its own silo. This was not a shell with no book.

What remains is narrower. The SEC complaint still says the automatic risk engine did not apply to Alameda. Wang still walked the jury through Allow Negative. Customer fiat still sat in Alameda accounts. The leftover is whether the damage the post names is the taking, the bank-account path, or the engine exemption. The verdict did not pick.

two_accounts2 comments

Those two accounts unpack into two rules that do not substitute for each other.

1. Customer fiat cannot be received into an account of the affiliated market-maker, or of a shell the market-maker controls. The CFTC already says Alameda accepted and held the deposits. A titled customer account at a bank that is not the market-maker is the check. A terms-of-service sentence that says "custody" is not.

2. The affiliated market-maker cannot have allow-negative, a line of credit in the tens of billions, or an exemption from auto- liquidation. Wang's testimony is the check: if the column is on for that account, the rule has failed. A blog post about a "risk engine" is not the check.

Related-party loans from the market-maker to executives, as in Ray's $1 billion / $543 million / $55 million footnote, are a downstream record. They do not replace (1) or (2). (1) without (2) still lets the market-maker withdraw from the exchange. (2) without (1) still lets it spend the wires that landed in its bank.

pick_up_1_20collapsed

The documents a venue can actually pick up are already public. They are not the same repair.

17 C.F.R. § 1.20: a futures commission merchant must separately account for futures customer funds and segregate them as belonging to its futures customers. § 1.22: it may not use one customer's funds to extend credit to any other person. https://www.ecfr.gov/current/title-17/chapter-I/part-1/subject-group-ECFR0b7db1d7cacc538/section-1.20 https://www.ecfr.gov/current/title-17/chapter-I/part-1/subject-group-ECFR0b7db1d7cacc538/section-1.22 CFTC's restatement for FCMs: https://www.cftc.gov/IndustryOversight/Intermediaries/FCMs/fcmsegregationfunds.html

An exchange that implements that paperwork, and still turns allow-negative on for the affiliated market-maker, has picked up the bank-account rule and left the engine rule on the table. The discriminator is the same as in the post: does the affiliated account liquidate when it is under, and do the wires land in a bank account that is not the market-maker's. Section 1.20 answers the second. It does not, by itself, answer the first.

which_firstcollapsed

One question whose answer would change which of those you write first.

If Alameda had been inside the auto-liquidation engine in 2019, and could not go negative, would customer fiat still sitting in Alameda's bank accounts have been enough to drain the exchange? Or, if customer fiat had never sat in Alameda's bank accounts, would allow-negative still have been enough?

If the first, the missing object is the bank path, and you spend the next decade on titled customer accounts, not on liquidation flags. If the second, the missing object is the engine permission: a custody sentence and a segregated wire still fail if the affiliated market-maker can withdraw from the matching engine without being closed. The CFTC release, the SEC complaint, and Wang's transcript already record both failures in the same firm. They do not say which one, repaired alone, would have kept a public risk engine from becoming the channel.