On-Chain Anomaly Detection: The FTX Foreshock
“Infamy, infamy, they’ve all got it in for me.” The final words of Kenneth Williams as Julius Caesar in the British comedy film Carry on Cleo. And, possibly, an insight into Sam Bankman-Fried’s state of mind on Sunday 6th November 2022 when CZ tweeted that he was dumping Binance’s FTT holdings, FTX’s native token. Not that he put it so bluntly. What he said was “As part of Binance’s exit from FTX equity last year, Binance received roughly $2.1 billion equivalent in cash (BUSD and FTT). Due to recent revelations that have come to light, we have decided to liquidate any remaining FTT on our books.”
And that was all it took. The announcement led to $6Bn of withdrawals from FTX within hours. By Tuesday the firm had run out of money and could no longer fund redemptions. Withdrawals were therefore halted while a rescue was arranged. CZ claimed to be interested in purchasing the firm and then backed out. By Friday 11th November, FTX and Alameda filed for bankruptcy protection. In just five days they had imploded via a combination of reckless leverage, poor management controls, a denial of credibility attack, and no FDIC backstop.
The whole episode came as such a surprise. Except that it didn’t. Let’s leave aside that we’d predicted FTX was four times more likely to go bankrupt than Binance back in July and focus on the immediate run-up. Specifically, as the graph shows, anyone who was monitoring FTX’s On-Chain balances would have detected anomalous trading patterns as far back as 28th September. That’s a full 44 days ahead of the bankruptcy filing. On that day, FTX’s balances went from $4Bn to $8Bn overnight. As the fitted red trendline shows, this balance dislocation was a 12 standard deviation event.
It’s hard to know exactly what was going on. But the balance change was entirely driven by an increase in FTX’s FTT holdings. Presumably, the sale announced by CZ had, in practice, already happened. Perhaps Alameda Research had led that re-purchase, needed to reduce its position, and sold its FTT to FTX in return for depositors’ cash. Maybe FTX had simply issued more FTT to raise money. Either way, what was entirely clear on 28th September was that there had been some kind of phase change and anyone with exposure to FTX should be reviewing their position.
Anomaly detection is not a simple problem. It isn’t just about looking for large outflows or percentage changes. It’s the science of identifying outliers that are unlikely enough that they indicate a deviation from normal behavior. By extension, this involves identifying relevant behaviors to monitor, such as balances, volatilities, flow patterns, and so on, building stochastic models of those behaviors, and determining just how unlikely an event needs to be to trigger intervention. But, these complexities notwithstanding, FTX demonstrates the value of undertaking such analysis.
