Despite assertions that only a small proportion of assets were custodied in a hot wallet, the exchange’s liquidation committee found that FTX and its related entities made little use of cold storage.
A first interim report released by the team overseeing FTX’s bankruptcy on April 9 outlines several instances where the crypto exchange and its affiliated companies misrepresented the amount of controls in place.
While the commingling and misuse of FTX’s user funds have been common knowledge for a few months, the security of those assets now appears questionable as well.
The debtors found that FTX stored private keys to its crypto wallets in a cloud computing environment leased from Amazon Web Services (AWS). The report further states that the FTX Group “kept virtually all its crypto assets in hot wallets.”
In 2019, Bankman-Fried responded to a question posed by an FTX user on Twitter about the extent of the exchange’s cold storage usage, saying that “a standard hot wallet/cold wallet setup” was in place. The FTX Group also told advisers and counterparties that the firm maintains a balance of crypto in hot wallets to cover two days of trading, while the majority of assets were stored offline.
At the time, FTX claimed that only if the balance dropped below the two-day figure would it be topped up with funds from its cold wallet. The debtors found that, in reality, there was no such system in place at FTX, FTX.US or Alameda Research.
Employees were reportedly instructed not to share information on the subject with regulators unless specifically requested, but if asked, would share that assets 70% of assets were held in cold storage. If “non-regulators” posed the question, employees would say “10% in hot wallet, and 90% in cold wallet.”
“In fact, neither of these assertions about cold storage use was true,” said the debtors, who found no evidence of a system to secure assets in cold storage, outside of Japan where it was a regulatory requirement.
FTX also did not use multi-sig addresses, rather storing the private keys to over $100 million worth of crypto in unencrypted plain text.
The debtors said they had to create their own technological pathways to transfer several assets to cold storage because the original team “had never engaged in the computer engineering necessary to make those transfers possible.”
Through these efforts, the debtors have managed to recover $1.4 billion worth of crypto to cold storage and are in the process of recovering an additional $1.7 billion.
