Hacker News new | past | comments | ask | show | jobs | submit login
FTX – The fraud was in the code (mollywhite.net)
143 points by clwg 11 months ago | hide | past | favorite | 95 comments



Pretty insane that Sam Bankman-Fried decided to plead not-guilty. And it's interesting that their defense is an implication that a witness is committing perjury for a lighter sentence without any evidence backing it up.

And just what in the world were any of these people thinking? Sam Bankman-Fried isn't remotely charismatic, so I just don't understand why people would follow his demands and actively participate in such obvious fraud. How do you reason with yourself about randomly generating an insurance fund's balance that has been testified, under oath to Congress and various other binding contracts I'm sure?


> Pretty insane that Sam Bankman-Fried decided to plead not-guilty.

Would easily bet that was his decision. He's obviously made insanely stupid choices already, like leaking Caroline Ellison's journal and getting his bail revoked.

I'm sure he was counseled against it, but his lawyers were probably like "well, he wants to swing the bat, and we get paid more if it goes to trial anyway."


>> Pretty insane that Sam Bankman-Fried decided to plead not-guilty.

>Would easily bet that was his decision.

That's a tautology. His decision to plead not-guilty is literally his decision.


it's obvious the parent comment means that he was counseled against it and decided to do it anyway because he's just like that.


rhetorical flourish notwithstanding, SFB still has enough cash to afford decent lawyers.

and decent lawyers would have told him to STFU and not do a bunch of things he did. and would have likely told him to plead out.


His decision - as opposed to what his lawyers could have possibly suggested to him.


It becomes more and more clear that he's just a sociopathic idiot, sort of like Miles Bron from The Glass Onion. I wonder how off his rocker he is from drug use.


Perjury*

Sam is highly charismatic, especially when all you want to hear is that you send 2000$ and will receive 100k$ if only you listen to him and use his product. He's part of the mumbo jumbo guru crowd.

I'm a programmer in finance: I understand nothing when SBF talks, it's like complete random BS, totally different from the traders I work with who would use complex concepts but with always a visible thread: utility -> transformation adding value -> profit, with SBF it's all so fuzzy and unclear, it's like he pretends to talk like we're idiots to hide the fact he's the idiot who forgot that you need to sacrifice potential upside for downside insurance...


I personally never found him charismatic at all, even before all of this got exposed. He has always seemed like a tweaker who thought himself smarter than he is, which is exactly what he turned out to be.

I honestly struggle to understand how anyone would listen to him for any length of time.


What if he paid you to listen? You know, hypothetically speaking


https://m.youtube.com/watch?v=2ozjiX1E7ZA&pp=ygUTc2JmIGludGV...

Picked an interview ar random. He is not charismatic, but he can talk like so many banking VPs talk ( almost no substance ). This may have helped him make people part with money.


Isn’t VP typically an entry level employee at a bank? If so, I would agree. He clearly doesn’t know when to stfu, he’s gonna get 30 to life


Asking for a friend?


> I'm a programmer in finance: I understand nothing when SBF talks, it's like complete random BS, totally different from the traders I work with who would use complex concepts but with always a visible thread: utility -> transformation adding value -> profit, with SBF it's all so fuzzy and unclear, it's like he pretends to talk like we're idiots to hide the fact he's the idiot who forgot that you need to sacrifice potential upside for downside insurance...

It appears that there is a sizable audience who will hear that and conclude he's a subject matter super genius and that you're a total idiot.


> It appears that there is a sizable audience who will hear that and conclude he's a subject matter super genius and that you're a total idiot.

Many of them the titans of SV no less, Sequoia being chief among them; honestly, I called this imbecile being in jail in mid-late '21 when he announced he was going to start influencing US politics. He was an idiot then and he has proven himself and even greater one with time. Likely mentally ill, as well.

I do want to underscore that this scammer would have NEVER gotten the chance he had were it not for the connections his family has at Stanford, and thus VC, and the litany of connections that followed. This article is a must read [0], as were the testimonies given by gyus like Scarmocci (I'm not going to correct his name), because it all boils down to the fact that he was the child of privilisge and connected to all the power-brokers in SV.

SBF, FTX and Alameda is and will always remain a a Silicon Valley VC backed cluster***, and it must be noted that this has nothing to do with us and everything to do with THEM.

> Silicon Valley could be said to be in the business of reality distortion. Fundraising for startups can be as much about narrative as about economic fundamentals. Most venture capital portfolios are filled with companies that will fail because their model is wrong, their product won’t land, their vision of the future won’t pan out. The high dropout rate means that everyone is in search of the one thing that will reach escape velocity. Everyone is looking for an epochal success—a Steve Jobs, a Jeff Bezos. That creates a degree of hunger—even desperation—that can be exploited by someone who arrives with a great story at the right moment.

0: https://www.wired.com/story/why-silicon-valley-falls-for-fra...


It's also funny to me that they just use Github and Google docs.

It seems like if you were committing massive fraud, you'd want to avoid leaving permanent records of it on someone else's systems.

But I think this is generational thing. If you grew up when web browsers were already prevalent, a "text file on your hard drive" probably means almost nothing. It's just not the way you use computers.

I also like this bit from the article:

Note to self: if you’re going to write code to do fraud, make it messy and unreadable to reduce the chances it’s later put in front of a jury as evidence.


I mean, the reason the fraud looks so brazen now is because they were obviously true believers - they never expected to get caught. If crypto had gone up and up and up forever as intended, the fraud would never have been discovered.

Of course, the other possibility is that at least having this amount of visible paper trail was intentional - the CTO probably had a little voice in the back of his head going "Umm, maybe committing multi-billion dollar fraud is a bad idea...", but the GitHub history probably helps him more than it hurts now, at the expense of SBF.


> If crypto had gone up and up and up forever as intended, the fraud would never have been discovered.

I'm not sure of that. When you need an account's credit limit set to $65 billion because the account (Alameda Research) kept hitting the credit limit, something is seriously, seriously wrong irrespective of the state of crypto. It seems like they were inevitably going to fail hard. FTX was literally allowing Alameda Research to trade with make believe money.

Some of the major traditional brokers will just up and close your account permanently if you abuse, even within their already strict rulesets, their margin accounts.


I made an earlier comment explaining it as SBF coming to believe that his tricks kept working so consistently that he regarded them as some kind of fundamental aspect of reality, that he could always find another investor to give him a reprieve, he could always find another sucker to buy FTT at an inflated value (sorry, “exit liquidity”).

https://news.ycombinator.com/item?id=33973023


> It seems like if you were committing massive fraud, you'd want to avoid leaving permanent records of it on someone else's systems.

Yes, I had to give my professional opinion on why some healthcare software here was breached so I asked the company to deliver the source: this software is written from begin 2022. They don’t use any normal (git, cvs, sourcesafe etc) versioning system; just zip files with dates in them. So they sent the ‘latest version’ and we found it’s not the same version as the breached version on the server. So they are saying they don’t know who or what ‘changed the deployed version’.


Actually yeah, this would allow the Dan Ariely defense.

He said he got a spreadsheet from a company, and also insisted he didn't doctor the spreadsheet. But he also admits he was the only person who handled the spreadsheet (presumably to not through his collaborators under the bus).

He simply says he doesn't know how to reconcile those facts -- that's "your problem" if you want to prove him guilty.

But since there's no version control, there's no smoking gun. His defense is basically "I don't know what happened but I'm innocent"

And plausibly some of the FTX defendants could have tried this, had they not left permanent records all over the place.

They could have worked with zip files with no provenance :-P

After all, the burden of proof is on the prosecution.

(though of course I'm glad they did leave records, and wish Ariely would have)


So - what I'm hearing is there is a potentially small but perhaps lucrative market for an onsite git system (because that's what programmers know how to use) that outputs zip files that can then be used as the code archive if Johnny Law comes calling?


It's scary how common it is even though you never hear about it on HN. We get so incredibly many 'versioned zips' via wetransfer, no password/encryption of vital company/gov/healthcare/etc systems...


Typical

And of course this is the "quality software" that is charged an arm and a leg for


> Pretty insane that Sam Bankman-Fried decided to plead not-guilty.

Prosecution have stated that they haven’t offered SBF a plea deal, so what incentive does he have to make their job any easier?


There is nothing more enticing than the smell of money. You don't need charisma. You need the air of "get you rich". That's it.


The code snippet where they generated the FTX backstop fund's "current balance" displayed on the website by multiplying the exchange's daily trading volume by a random normal number is NUTS!

This was the supposed crypto wonder-platform!


As someone relatively involved in the crypto space the past few years, no one saw FTX as anything to be proud of. It was a centralized exchange, basically a web2 company that handled crypto. Only the TradFi VCs (the Mr. Wonderfuls of the world) spouted rhetoric like that. The engineers building out the chain ecosystems & protocols on top of it never thought much of it other than another place to trade with orderbooks (i.e. centralized company).


the funniest part about FTX was how utterly awful it was. books were thin, and everyone knew alameda was hunting customers in the books, while listing perps for their farm and dump investments. really just a sham of an exchange/casino, so around average by crypto standards, but KOLs and mainstream comms praised them.


> KOLs and mainstream comms praised them

I know this will just get me labelled a conspiracy theorist but I refuse to believe his well-connected parents had nothing to do with the praise FTX received in the mainstream media.


Really curious why you'd make this distinction?

> web2 company

Are web3 companies less fraudulent?


Cryptobros try to pretend because "web3" is blockchain, that the blockchains will reveal anything bad before it can happen.

Completely untrue, of course. There's always a real-world link(because otherwise nobody would be profiting(people want stuff)/nothing would actually happen)


Aave cannot fake its risk parameters because it's fully on chain and anyone can check them.

Crypto scams are always off chain (like FTX and many more) or have smart contracts that can be upgraded by anyone (but again, anyone can check that the contracts can be upgrade and by whom).


> basically a web2 company

Also known as a company.


It is insane how there wasn't a single shred of accountability. I just wonder who was giving them tens and hundreds of millions of dollars without any auditing or due diligence. It seems even the most superficial audit would have revealed it to be a sham.


Sequoia led their one of their rounds, everyone assumed sequoia did enough due diligence, everyone goes in and fills the round; it's assumed its a trustworthy platform for retail


That's exactly how most funds operate. They don't want to spend the time and money to do due diligence so they just wait around for one of the bigger funds to supposedly do the due diligence. So if they see them invest, they will join the round. it's so much easier to fill out a round one you get your first big VC on board.


I honestly feel Sequoia should be held partially responsible for funding and marketing such a blatant criminal enterprise. I'm a little tired of these venture capitalists claiming all innonence when they should have a burden of responsibility. They want all the upsides and none of the downsides to throwing millions at people.


Yeah try talking with a VC while you play videogames and see where it leads you

But since it was the "wonder kid of crypto" (read, very well connected person) it was a reason for praise

Yes please explain me how he really merited that


They could be held partially responsible as they could have their fund LPs sue them for negligence, especially if they had any materials detailing that they did diligence.

They won’t be though, because everyone would be afraid for future repercussions. That said, they’re on a list of VC firms I would hesitate to take calls from going forward.


Plus VC get the most insane tax break, ability to roll over some percent of their gains tax free into perpetuity until they withdraw, the withdrawal gets taxed. I understand that helps compensate for risk, but it also means they can swing at the fence with FTX and that microfluidics scam Elizabeth Holmes.


>They want all the upsides and none of the downsides to throwing millions at people.

I see what you're getting at, but this is a bit of a silly statement. The obvious downside of "throwing millions at people" is that you lose millions of dollars.


It's not a right to have a guaranteed return on an investment. It isn't silly at all. They literally only want a single downside (losing their initial investment), absolving themselves of all responsibility for their investments while retaining maximum return in the event such a return on investment happens. They will also do everything they can, a la various modes of propaganda, to manipulate avoiding that single downside as well.

The startup culture that has fetishized making it big at all costs (move fast and break things) has lead to customer (and non-customer) deaths amongst several other massive failures. The investors should have some responsibility and accountability assigned. Right now, they have zero.


The downside of throwing millions of dollars at someone is losing those millions, which they did. You are basically suggesting that a fraud victim should be punished more than the money they lost because they were too stupid to see the fraud.


We punish banks for failing to do proper KYC even when they're also victims of fraud.


> You are basically suggesting that a fraud victim should be punished more than the money they lost

Their actions brought in more victims, and therefore investors ought to be wary of listening to them in future. They ought to be also punished by a hit to their reputation i.e. by being held partially responsible.


They didn't "bring" in more victims, more victims joined in because they were lazy, just like most of the VC industry.


> more victims joined in because they were lazy...

They were lazy because they relied on the reputation of who was pushing for FTX, now their reputations won't be so rock solid. That's some justice.


It's a bit strong to call Sequoia "fraud victims". They were at a minimum incompetent and at a maximum intentionally misleading to other investors. You shouldn't write an article like this (https://archive.ph/GQkCp) unless you have done your research. Did they do literally any due diligence prior to leading a massive investment round?

Just because they stand to lose millions doesn't excuse their responsibility and influence. Venture capitalists have no one to blame but themselves for the risky companies out there. They are effectively snake oil salesmen, just looking to siphon off relatively short-term profits under the guise of "changing the world".


Isn't it a bigger indictment of the "follower" investors who did no due diligence of their own because Sequoia was investing? Why would anyone trust their money with these investors instead of investing with Sequoia if that's all they do?


In my opinion, it's all of the above.


Wild to see some actual code from the FTX repo. Laughed at the takeaway of making sure you at least hide your fraud behind some messy code.


Or more realistically compiled code where your fraudulent methods exist in patches you don't commit to git.


I remember working somewhere as a contractor and given a legacy piece of code to update. And then that went ok so later they approached me again but this time with much less clear requirements. It became a stalemate, me asking them to clarify, them pointing to their watches and saying when can this be done. Eventually they tried to pressure me into basically add a backdoor. I almost did this but eventually explained in my pr why the code want not safe and would lead to possibility of unauthorized crap. Everybody else was extremely junior and seemed to be unaware of this.


A tip: If you intend to commit fraud or other illicit activity dont host / store your code on Microsoft GitHub.

Hmm in fact dont use git at all.

Law enforcement only need to find a single developer pc/laptop/whatever and they will have the entire history, comments, who did it, and code.

Having it all in a centralized system that is configured to be easily nuked is safer, than trying to nuke every laptop/pc/whatever that has a copy.

Of course, the entire code base will probably be available on any laptop/pc/whatever that LE can seize, but it is less data than with git.

I wonder if you could do the development all on ram drives on the development machine, that way if you shut down all the code is gone. Just make damn sure to stow/check in your code before doing so.

I have partially done this myself a several years ago, but that was only to try and speed up compile times.


At what point is it less work to just build something real rather than have all these workarounds to support a fraud?


> I wonder if you could do the development all on ram drives on the development machine, that way if you shut down all the code is gone. Just make damn sure to stow/check in your code before doing so.

or if you have any downtime you lose all of your shit


It is best practice to check in, or stow code regularly even on regular machines, in case the HD fails, the computer explodes, or whatever else.

May have to be a bit more dilligent but not a big change.


True, but git also has pretty simple means to fake committer identity, rewrite commit history etc. Storing it to GitHub was definetely a major faux pas.

However, it seems that the FTX people were not really bothered to cover their tracks.


There has obviously been some bad stuff going on over at FTX, but is the counter on a website really the "most" proof that they could find?

https://www.ycombinator.com/ Is every number on that page real time accurate? Is the combined value $600bn - if it is 599bn or even 601bn then ding ding ding we have ourselves fraud.

https://en.wikipedia.org/wiki/National_Debt_Clock - Can I get any and all people behind this (and Similar Projectes) jailed for fraud?


You’re missing the broader context here. The prosecution is alleging massive fraud, while SBF’s defense is that he wasn’t committing fraud, he was just incompetent. So a lot of the trial hinges on presenting evidence one way or the other for the fraud-or-incompetence question. Things like the counter, which was clearly deliberate and specifically engineered to lie to customers, establish a pattern of deception and make it very hard to allege incompetence. The counter is unimportant in and of itself, it’s how it undermines SBF’s defense.


They guy had a personal net worth of ~$100bn; lost all that and $8bn of other peoples money. The prosecution have cracked open the books, turned every single employee, and this is their smoking gun?

I will at least say, "goes to character", is absoultely an excellent and as I see it the only logical answer. If however, they have to play that game and that is all they have then they are going to struggle to make a legitimate case.

Maximum entertainment value from the sidelines will be not guilty with all the other FTX employees having plead out!


> The prosecution have cracked open the books, turned every single employee, and this is their smoking gun?

We are not even one week into a six week trial. This particular fraud is only one small part of their overall case.


The backing of that number was testified to, under oath, to Congress, which by itself is a felony.

I haven't been following the trial though, and I'm unsure of how much testimony was given. What's reported on this blog does seem like it is a little small given Gary Wang's large role.


> The backing of that number was testified to, under oath, to Congress, which by itself is a felony.

He did not testify that the number on the website was real. He testified to the existence of the insurance fund and the single biggest daily drawdown from the fund.

"which by itself is a felony" - wouldnt you mention that as the prosecution??? Or are they aiming for a mistrial on the grounds of incompetence?

> Prosecutors haven’t mentioned it, but Sam Bankman-Fried would go on to testify under oath in front of the U.S. Congress in May 2022 that “the insurance fund has paid out a net total of $9.5 million” in the preceding three years, and that “the single biggest daily drawdown from the FTX.com insurance fund was $4.7 million.”

Actual testimony. https://www.congress.gov/event/117th-congress/house-event/11...

> Finally, prosecutors questioned Wang about the FTX “insurance fund”, which was ostensibly supposed to protect both FTX and its customers from trades that went badly even more quickly than the exchange’s risk engine could account for.

> One such example was in 2021, when a trader was able to exploit a bug in FTX’s margin system that allowed them to take out a massive position in the MobileCoin cryptocurrency. They were eventually liquidated, and FTX suffered a loss of “several hundred million dollars,” according to Wang.

The losses to the exchange from a failure of the code should be borne by the exchange not from any "insurance fund" whos purpose is the make good slippage losses for customers. There are grounds to ask why they passed the loss off to Alameda (in which case FTX co was defrauding Alemada co for an FTX mistake).

I see the narative that the prosecution is trying to push, but unless SBFs laywers are idiots they should be pointing out that they are trying to connect two distinctly different dots.


If you actually look at the article the very first code sample shows how certain customers (Alameda) are directly exempt from auto liquidation & can carry negative balances at FTX.


> certain customers (Alameda) are directly exempt from auto liquidation

Certain customers (including Alameda) - I understang other customers had similar arrangements, and why wouldnt they? Every account was trading on margin and high leverage - the reason you auto liquidate is so they dont run off owing you money.

Is it fraud for a company to extend credit to another company? Any company that issues a invoice and allows say 14 days to settle is extending credit to the other party.


It is most certainly fraud to lie about protections in place to protect customer assets. That includes backstop insurance and auto-liquidation practices.


Off-topic:

The "listen to the article" feature on this blog post ... is it using an AI voice trained specifically on the author's real voice? Or is it a real recording by any chance?


You can google and listen to her giving talks. It's clearly her real voice.


This is besides the point, but is this actually valid Python?

    if not account.allow_negative:
        if (balance.available_ignoring_collateral if ignore_collateral else balance.available) < 0: 
            raise BadRequest('Account does not have enough balances')
Not sure what's going on inside that second if statement.


I think it is? I don't have much python experience, but I think that inner expression is equivalent to

   ignore_collateral ? balance.available_ignoring_collateral : balance.available
Personally I would agree that it would be clearer if the syntax was more differentiated between a conditional expression and a statement.



Python's (T if C else F) is most languages' (C ? T : F)


Python ternary.


Was the exchange actually running on Python? Or was Python used for less intensive stuff?


Python usage != incompetent financial institution.

1) even before the speedups done now on CPython, PyPy has always existed (and NumPy was HW-accelerated)

and more importantly 2) It has a native arbitrary-precision decimal type. Even other languages seriously used in financial institutions like OCaml (https://discuss.ocaml.org/t/ocaml-needs-an-arbitrary-precisi...) doesn't even provide it natively.


OCaml is used by Jane Street but no one else in this space (certainly no major player). Jane Street are a successful and respectable company but no giant, by any standard. If anything, I'd say their fame for using OCaml is greater than their fame as a trading firm.

The benchmark would need to be Java or C++, which are the mainstay of the industry.


I actually sort of suspect that the most common reason for people to have heard of Jane Street is their advertising for internships on maths related YouTube channels. (Not the most common reason for their customers or partners, just the greatest number of people)


SBF worked at Jane Street, for what it's worth.



Thanks I appreciate the info. I love python and I use it for nearly everything. But it often gets dogged for perf, so I wonder about the reasoning in using it for high frequency trading despite the bad rap.


All banking is becoming like a casino where the house alone knows the code.


No, this is just extremely blatant fraud. Banks in general don’t do this.


I believe every U.S. global systemically important bank has engaged in bid rigging or rate rigging.


You believing in it doesn't make it true.


How would we know? The code is not open source


The code is not relevant. The fund position is transparent to the regulators


The position is visible to regulators via code - if the code is fraudulent or buggy, the regulators will believe false information.


Financial audits of public firms are not done through code. They're done by CPAs who copy files and generally run everything through generic Microsoft applications that aren't going to commit fraud for a bank.


At least at the firms I’ve worked with, new records were digitized and old files were undergoing digitization. Maybe it’s different in your country?

There’s always some process a firm must use to make digital records available to an auditor - it’s at this point in the step code must be trusted even if it’s supposed to be as simple as “make everything available “.


> it’s at this point in the step code must be trusted even if it’s supposed to be as simple as “make everything available “

The "step code" here is a group of humans adding documents to some type of storage available to the auditor.

There is no question of fraud in that code because it's generic. Microsoft, Box, Dropbox, etc. aren't building in custom code to commit fraud.

When publicly-audited firms commit fraud, it's not an issue of untrustworthy code. It's because humans are going to some trouble to commit fraud. There are even "checksums" (balances) that tell you if something is accidentally missing, so it's rare that financial fraud can be conflated with an innocent mistake.


"Some have wondered why Wang chose such a seemingly arbitrary number as $65,355,999,994"

int((2^16 - 180) * 999999.9999 + 1) = 65,355,999,994


This proposed explanation just moves the abitrariness to "why 180" and "why that amount of 9s"?


(65,355,919,909 + 80,085) = 65,355,999,994 obviously /s




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: