Quick Answer — When FTX collapsed in November 2022, its “cold” wallets began draining hundreds of millions in unauthorized transfers while the exchange was in freefall — later reporting traced movements of over $600M with roughly $400M+ eventually attributed in court to FTX founder Sam Bankman-Fried himself. The security story isn’t a hack by outsiders: it’s that custody without controls means “unauthorized” is undefined — the same private keys served trading, embezzlement, and bankruptcy lawyers. The lesson: centralized custody is a single point of total failure, and key governance is the control nobody audited. (Note: this article covers a security event; see web vulnerability primers for background.)
What happened
Per court filings, bankruptcy-testimony reporting, and contemporaneous analyses:
- The collapse. November 2: CoinDesk’s balance-sheet report on FTX’s Alameda arm. November 6: Binance announced it would sell its FTT holdings; the run began. November 8: FTX halts withdrawals. November 11: bankruptcy filed.
- The “hack.” November 11–12, as bankruptcy hit, ~$400–600M in crypto moved out of FTX-controlled wallets in irregular transfers. The exchange’s general counsel scrambled; a Telegram channel posted “FTX has been hacked” from an official account. Initial read: external attacker amid the chaos.
- The courtroom reversal. Testimony and filings in Bankman-Fried’s 2024 trial developed a different picture of overlapping unauthorized transfers — customer funds moved to Alameda, keys held in a shared platform with no segregation, and the bankruptcy-eve movements became part of the fraud narrative rather than a separate heist.
- The “backdoor” question. Early reporting cited a claimed software backdoor letting Alameda hide liabilities; disputed in later testimony. What survived scrutiny: commingled custody, absent controls, and privileged access concentrated in a tiny circle — governance as root cause.
Impact and numbers
| Metric | Value |
|---|---|
| Bankruptcy | November 11, 2022 (FTX + ~130 affiliates) |
| Customer shortfall | ~US$8B in customer claims (estate recovered billions by 2024) |
| Bankruptcy-eve movements | ~$400–600M irregular transfers, attribution contested → largely SBF-linked per trial |
| Root cause | Commingled custody, absent key governance, software raising flags ignored by humans |
| Criminal outcome | SBF convicted November 2023 (7 counts); sentenced 25 years (2024) |
| Market | Crypto winter deepened; regulation accelerated globally |
Why custody was the vulnerability
Crypto’s pitch was removing trusted intermediaries; FTX showed what happens when the intermediary is trusted anyway — and is improvising. Customer assets mixed with the market-maker’s treasury; private keys accessible to a handful of people with no dual control; risk-engineering alarms overridable by founders; audits that never existed for the group’s core. Every “hack-like” event in the collapse — the bankruptcy-eve drains, the vanishing tokens, the mysterious transfers — decomposes into the same base anomaly: nobody could tell authorized from unauthorized movement, because no control boundary defined the difference. That’s not a cryptography failure; it’s a governance failure wearing cryptography’s clothes.
Timeline
| Date | Event |
|---|---|
| 2022-11-02 | CoinDesk balance-sheet report on Alameda |
| 2022-11-06 → 08 | Run on FTX; withdrawal halt; rescue talks collapse |
| 2022-11-11 | Bankruptcy filed; irregular wallet movements (~$400–600M) begin |
| 2022-11-12 | “FTX has been hacked” posted; Bahamas regulators seize control |
| 2023-11 | SBF convicted on seven fraud/conspiracy counts |
| 2024 → 2025 | 25-year sentence; estate recovers assets for creditor distributions |
Why it still matters in 2026
Post-FTX, “proof of reserves” became a marketing checkbox, but the durable reforms are boring and structural: custody segregation (customer assets in bankruptcy-remote structures), key governance with dual control and audit trails, and independent proof-of-liabilities systems that reconcile claims cryptographically. Regulators (US, EU’s MiCA, and others) now write these into licensure. For security architects, FTX is the canonical case that insider risk + key access = unlimited transfer capability, and the mitigation is the same as for any privileged treasury system: separation of duties, treasuries tiered by amount, and movement approvals that survive founder override. The collapse also recalibrated the industry’s answer to “not your keys, not your coins”: the real lesson is “whose keys, under whose approval, with what audit trail.”
The failure, in one diagram
customers
|
deposits ──> FTX hot wallets
|
(no segregation:
customer funds ≈
Alameda treasury)
|
tiny circle holds keys
(no dual control,
no movement audit)
|
Nov 8: run, halt
Nov 11: bankruptcy
Nov 11-12: irregular
transfers out
(~$400-600M)
|
"hack"? later:
fraud, per trial
control gap: nobody
could define
"unauthorized"Detection and hardening takeaways
- Segregate custody structurally. Customer assets live in bankruptcy-remote wallets/entities — not commingled with operating treasuries.
- Dual control on treasury movement. No individual — founder included — can move amounts above defined tiers alone; approvals logged immutably.
- Reconcile claims independently. Proof-of-liabilities systems let customers verify their balance is in the pot without trusting a dashboard.
- Protect the whistleblowers’ path. FTX’s risk function flagged the concentration and was overridden; escalation channels that bypass the audited party are a control.
- Audit the group, not the logo. The missing audits were at the holdings level where the commingling lived; license the structure, not the front brand.
Was FTX hacked by an outsider?
There was a widely-reported incident of unauthorized transfers on bankruptcy day, initially called a hack. But trial testimony and filings attributed the vast majority of the irregular movements to insiders — Bankman-Fried and confederates — as part of the fraud. A residual chunk of the bankruptcy-eve movements remained formally unattributed in public record. The defensible summary: chaos-day movements, mostly insider-attributed per court findings, with the term “hack” surviving mainly as the era’s shorthand.
What was the “backdoor” claim?
Early Reuters reporting cited sources describing software that let Alameda conceal liabilities from the exchange’s risk systems — the famous “backdoor.” Later testimony complicated that account: the flagging existed, humans overrode or ignored it, and concealment may not have required hidden code so much as unfettered privileged access. Either way the control lesson holds: privileged access without auditability is functionally a backdoor, whether or not anyone wrote one deliberately.
Did customers get their money back?
Substantially, yes — an unusual ending for an exchange collapse. The estate recovered billions in assets, and by 2024–2025 courts approved distribution plans repaying a large share of claims (often at petition-date valuations, a bitter wrinkle given crypto’s later appreciation). The recovery was possible because the assets existed and were mostly traceable — the failure was control, not custody technology itself.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
