Summary: We recently obtained information about Tether’s secured loans operations from a source familiar with the matter. This source identified Ethereum addresses used to process both loan interest and principal payments. We validate this claim using data from the Celsius Network bankruptcy. We then identify previous and current addresses that appear to be loan customers of Tether, including several well-known crypto entities. Finally, we estimate the total loan amounts represented by this dataset, demonstrating that we can account for 100% (or more) of Tether’s reported secured loans in 2021, and around 20-30% of their reported secured loan book as of their most recent attestation (assuming we can trust their numbers).

Tether, the $89 billion stablecoin that acts as the lifeblood of the crypto-conomy, has long faced questions about the assets backing their tokens. A stablecoin should remain “stable,” pegged to whatever real-world currency unit it represents on the blockchain. The second largest stablecoin, USDC, is issued by a New York-based company called Circle Financial. They regularly publish a detailed accounting for the assets backing their tokens. According to their reports, USDC is backed by short-dated U.S. Treasury bonds and cash held in bank accounts. Simple, right?

In contrast, Tether’s reserves are somewhat more… exotic. Of course, to discuss Tether’s reserves one must first play devil’s advocate and assume that Tether’s claims regarding their reserve portfolio are accurate. After all, Tether has been caught lying about their reserves in the past. Analysts have demonstrated that the supposed performance of their reported portfolios stretch the limits of credulity. And importantly, the procedures underlying the third-party validation of their reserves by accounting firm BDO are quite limited and rely on management’s assertions. (These reports are colloquially referred to as an “attestation,” although this is a misnomer.)

Assuming Tether has found the error of their ways and is now being honest with us about the reserves backing their tokens, one finds that the Tether portfolio managers have a decidedly more risky approach than their main competitor Circle. Per previous attestations and document releases, Tether tokens have been backed by Chinese commercial paper, Bitcoins, precious metals, “other investments,” and secured loans to “non-affiliated entities.”  

The last category, secured loans, has been of interest for investigators and journalists. Tether has never publicized who they lend to or the terms of the loans. That veil was pierced once about two years ago, when the bumbling Celsius Network CEO Alex Mashinsky let slip that Celsius had borrowed around $1 billion from Tether using Bitcoin as collateral:

“If you give them enough collateral, liquid collateral, bitcoin, ethereum and so on . . . they will mint tether against it,” [Mashinsky] said…“New USDT is issued for such loans,” he added, and later destroyed when the loan is closed “so it does not permanently increase USDT in circulation”.

However, until now there has been minimal public information available about Tether’s loan book.

Identifying Tether’s On-Chain Loan Activity

Recently, we established contact with a source familiar with Tether’s process for issuing and collecting secured loans. This individual described the terms of the loans and provided a list of three blockchain addresses used by Tether to issue and redeem loan principal and to collect interest payments from their borrowers. According to this individual, Tether uses their main treasury addresses on Tron and Ethereum to issue and redeem loan principal. A third address (we will refer to it as the “Tether Interest Address”), not annotated by any available blockchain analytics platform (we checked Etherscan, Arkham, and Nansen) was reported to receive interest payments on the loans. We observed that the Tether Interest Address receives transfers from multiple addresses and that these transfers cluster around the first of each month. Once a large balance builds up, the funds are then transferred to a second address (Bitfinex deposit) and then immediately transferred again to the Bitfinex exchange hot wallet.

Absent confirmation from a second source, we decided to examine the available data to see if there was a way to support these assertions. We realized that there was an excellent data source available. After its collapse and subsequent Chapter 11 filing, Celsius Network’s relationship with Tether was examined in some detail. On their collapse, Celsius owed around $900 million to Tether; this was paid when Tether reportedly liquidated Celsius’ Bitcoin collateral. The Celsius bankruptcy examiner’s report also provides a few other values for the balance of Celsius’ Tether loans in 2021.

Fortunately, due to our prior work examining Celsius Network’s cryptocurrency movements we had established a robust map of their Ethereum addresses. To test whether Celsius received loan disbursements and made repayments to Tether’s treasury address, we filtered the Tether treasury’s transaction history for probable Celsius addresses. We then obtained a running total of the estimated balance of Celsius’ loans using this dataset:

This dataset tracks closely with the data provided by the bankruptcy examiner’s report. For example, we obtain a value of $890 million as the final Celsius loan balance; this is within a few million dollars of the amount reported by the examiner.

We conclude with high confidence that Celsius’ loans from Tether were disbursed and repaid via the Tether Treasury address.

Next, we proceeded to examine the transaction list from the identified Tether Interest Address. Again, we filtered for known Celsius Network addresses. We then examined whether the amount of the monthly payments was correlated with the loan balance. We determined that there was an 89% correlation between the monthly payments and the loan balances over time.

Next, we used Alex Mashinsky’s stated “5-6%” interest rate to estimate the principal amount that would correspond to the interest payments. Despite the rough nature of this estimate, these values again match closely with data from the Celsius examiner:

We conclude with high confidence that Celsius made interest payments to Tether via this address.

Who else does Tether lend to?

After confirming that Celsius used the identified addresses as described, we examined the other entities that have interacted with the Tether Interest Address. We discovered that several addresses are associated with known entities according to blockchain analytics platforms Nexo, Arkham, and/or Etherscan. Among these were the crypto lenders Babel Finance (insolvent) and Nexo and crypto trading firms Three Arrows Capital (insolvent) and Amber Group. We also identified addresses associated with the Bitfinex, OkEX, BTCTurk, and Binance cryptocurrency exchanges.

We searched the Tether Treasury address to see if the same entities showed up. Indeed, we discovered that the identifiable entities that made monthly transfers to the Tether Interest Address also sent and received funds from the Treasury. We also observed this pattern for several addresses that are presently unidentified. This pattern matches the behavior of Celsius Network, suggesting that these parties borrowed from Tether via a secured loan mechanism.

As of December 1st, there appear to be seven borrowers making monthly interest payments, based on the similarity of the payment amounts over the past few months. The largest payments are transferred from the Bitfinex hotwallet. (Note: this doesn’t mean that Bitfinex or OKX are Tether borrowers, only that someone used these exchanges to make the transfers to the interest payment address).

How have Tether’s secured loans changed?

We used the total interest payment dataset to estimate the principal amount represented over time:

Finally, we wanted to examine whether this dataset agreed with Tether’s reported secured loan balances. Using average interest rates of 6% and 8%, we estimated the loan balances represented by this dataset and compared them to Tether’s official numbers. Notably, our estimates are quite close to Tether’s reported numbers for 2021. (It is interesting that our estimates at times exceed Tether’s reported loan balances. We wouldn’t draw too strong of a conclusion yet; just note that if their average interest rate in mid-2021 was 6% or lower there might be a problem here!)

However, starting in June 2022 the numbers diverge significantly. While the balance represented by our dataset declines to around $1.2-1.5 billion, Tether’s secured loan balance rose and remained relatively stable from that point forward, hovering between $5 to $6.2 billion.

As we shared at the beginning of the article, we were informed that Tether’s Tron treasury address is used to issue and redeem loans on that blockchain. However, we have much less insight into the addresses on that chain and were unable to obtain a Tron interest payment address to use as a filter for possible borrowers. It is quite possible that Tether has issued a significant amount of loans using that blockchain.

We also note that a lot of things started going wrong in May and June of 2022…

Conclusion: How Tether issues billions of “dollars” that aren’t dollars at all

Based on the current dataset, we can estimate that Tether issued many billions of USDT backed by crypto collateral. The impact is far larger than one might assume just from looking at the loan balances. For example, Tether lent Celsius Network just over $4 billion in total. Our data indicates that other parties like Amber and 3AC similarly received billions in loans, which round-tripped their way through the crypto-conomy without ever touching the real financial system or ever being backed by real money….

Many questions remain unanswered:

• What percentage of Tether’s “redemptions” are actually loan repayments?

• What is the impact of cycling billions of crypto-backed USDT through the crypto markets?

• And, why did Tether’s reported secured loans massively diverge from this data starting in May/June 2022, around the same time as Terra, Celsius Network, and Three Arrows Capital collapsed?

We note that these revelations, while quite interesting and useful, do not provide any substantive evidence either to confirm or contradict Tether’s claims regarding their secured loans. However, this information does provide a first look inside Tether’s loan business and will give our friends in journalism and analytics another piece of the Tether reserves puzzle.

Coda: What about the Bitcoin?

As an aside, we wanted to note something we observed while writing this article. On Tether’s attestation reports, they list a “Bitcoin” category as part of their reserves:

Checking the footnote for “Bitcoins,” we find:

The “Bitcoins” category comprises Bitcoins held on-chain in wallets controlled by the Group.

The language “controlled by the group” is interesting, because Tether by definition controls any addresses holding Bitcoin collateral for their secured loans. We know from Mr. Mashinsky that Tether over-collateralizes their secured loans. Is it possible that Tether is including these “extra” Bitcoin in their reserves?

On May 5, 2023, Bloomberg reported that the cryptocurrency exchange Binance is under investigation by the Department of Justice for allegedly violating sanctions against Russian parties:

The inquiry by the Justice Department’s national security division is looking at whether Binance or company officials ran afoul of sanctions related to Russia’s invasion of Ukraine, according to five people familiar with the matter who asked not to be named discussing a confidential investigation.

There is already significant evidence in the public domain suggesting Binance may have committed sanctions violations. In January 2023, the U.S. Department of Justice indicted the leader of the Russian cryptocurrency exchange Bitzlato for unlicensed money transmitting and money laundering violations. In an accompanying order, the Financial Crimes Enforcement Network (FinCen) reported that Binance was one of the major counterparties to the Bitzlato exchange:

Approximately two-thirds of Bitzlato’s top receiving and sending counterparties are associated with darknet markets or scams. For example, Bitzlato’s top three receiving counterparties, by total amount of Bitcoin received between May 2018 and September 2022, were 1) Binance, a VASP; 2) the Russian-connected darknet market Hydra…

The recent CFTC complaint against Binance offers another example of Binance’s attitude towards doing business with questionable Russia-linked entities. According to the complaint, when a large Binance customer was found to have “over 5m USD worth of transactions indirectly sourced from questionable services,” Binance’s former Chief Compliance Officer Samuel Lim responded:

Can let him know to be careful with his flow of funds, especially from darknet like hydra

He can come back with a new account

But this current one has to go, it’s tainted

Hydra was an infamous darknet Russian crypto exchange and mixer that offered its services to drug dealers and other organized criminals. Hydra’s founder was arrested and indicted in April 2022 for conspiracy to commit money laundering.

We have uncovered yet connection between Binance and the potentially illicit flow of funds out of Russia. We have previously discussed Binance’s payment processor Advcash, a Belize-domiciled and apparently Russia- and Kazakhstan-based financial firm. We recently obtained screenshots of Advcash’s customer interface, which is unavailable to U.S. users. These images demonstrate Advcash currently offers to convert Russian rubles from sanctioned banks like Sberbank and Rosbank into U.S. dollars held in the customer’s digital Advcash wallet. They do so by linking their customers with “independent exchange providers” with exotic names like “CoinPayMaster,” “Obmennik-UZ,” and “Bankcomat:”

Advcash offers similar services by credit card:

Advcash also offers to help move cash rubles to the digital Advcash wallet in amounts above $5,000 USD:

According to Advcash’s site, you can even move rubles to USD from your Binance account:

Note that Advcash states that these services are provided by third parties. However, the end result is that funds from sanctioned entities end up in Advcash’s bank accounts. Customers can then convert rubles to USD, Euros and many other fiat currencies within the Advcash system.

From there, Advcash customers may transfer funds from their Advcash digital wallet to other entities including the crypto exchanges Binance, Bybit, OKCoin, Kucoin, and others. Alternatively, Advcash customers can directly buy crypto on the Advcash platform, a service provided through the company’s partnership with Binance.

While these findings do not definitively prove illegal activity, the services offered by Advcash certainly seem problematic in light of sanctions related to the current war in Ukraine. Based on the services advertised on their site, it seems possible that Advcash could be used to evade sanctions on Russian banks. For example, one could use a third party service (shared by Advcash) to move rubles from sanctioned Sberbank into an Advcash wallet. The customer could then purchase crypto on the Advcash site, using services provided through the Binance partnership, and then transfer that crypto to Binance or a different crypto exchange. By cashing back out to fiat currency, the customer could successfully avoid the Western blockade of the Russian financial system.

With Binance under the harsh light of formal criminal investigations, we wonder what investigators probing Binance will think about their partner Advcash’s interesting business model…

After the collapse of Silicon Valley Bank and Signature Bank in mid-March, depositors and investors scrambled to identify and flee other troubled banks. One surprising target for panic was Charles Schwab, the well-known brokerage firm that also owns T.D. Ameritrade. Unlike the other names in the news, Schwab is not (at least on the surface) primarily a bank. Schwab’s primary services for its customers are brokerage, asset management, and investment products.

However, Schwab also quietly operates one of the largest banks in the United States, into which it sweeps customers’ brokerage account cash. The realization that Schwab, like other banks, had significant unrealized losses on its securities portfolio led to a brief panic that the company might meet the same fate as SIVB. However, Schwab issued a statement indicating that their institution would survive a run due to ample liquidity:

We have access to significant liquidity, including an estimated $100 billion of cash flow from cash on hand, portfolio-related cash flows, and net new assets we anticipate realizing over the next twelve months. We believe we have upwards of $8 billion in potential retail CD issuances per month, plus over $300 billion of incremental capacity with the Federal Home Loan Bank (FHLB) and other short-term facilities – including the recently announced Bank Term Funding Program (BTFP).

In an interview with the Wall Street Journal around the same time, Schwab’s CEO made the bold claim that they could pay out 100% of deposits without having to realize any losses on their securities portfolio:

“There would be a sufficient amount of liquidity right there to cover if 100% of our bank’s deposits ran off,” said Walt Bettinger, Schwab’s co-chairman and CEO, referring to the company’s banking unit. “Without having to sell a single security.”

While he was correct in the short term, Mr. Bettinger’s statement hints at the longer-term problems that Schwab now faces. Schwab has profited on the spread between near-zero interest deposits and higher interest securities, a strategy that accounted for nearly 25% of net revenues at the end of 2022. However, Schwab has been bleeding the low-interest deposits that made their current business model viable. As Schwab races to replace these funds with higher-interest alternatives, the company is dismantling one of the key foundations of its business model. While the future is uncertain, it seems likely that Schwab is going to have a pretty rough 2023…

Schwab’s balance sheet suffered as interest rates rose

In addition to operating their brokerage and investment advisory services, Schwab owns three banks that it uses to hold brokerage clients’ cash. Dollars in brokerage accounts are “swept” to Charles Schwab SSB, Charles Schwab Premier Bank, and Charles Schwab Trust Bank. Between these three banks, Schwab held over $366 billion in customer deposts, with over 90% of the deposits held at Charles Schwab SSB (as of December 2022).

Schwab has deployed these to purchase large quantities of mortgage-backed securities and Treasuries. By December 2022, Schwab held mortgage-backed securities totaling $259 billion or 78% of their securities portfolio. Of the $333 billion in securities held, approximately 75% have maturities exceeding five years.

Note the second column: Schwab had gross unrealized losses of close to $27 billion on these holdings during 2022. As interest rates rose, the market value of their relatively low-yield and long duration debt instruments plummeted. Techically, this means Schwab saw comprehensive loesses of $14 billion in 2022:

Now, as Schwab has previously stated, one must be careful when accounting for unrealized losses on debt securities. If the company can find alternative sources of liquidity to pay out withdrawals, they can avoid realizing these losses. As long as the securities are held to maturity, there will be no real loss to the company.

We agree that Schwab will probably not be forced to realize these losses. Instead, it is the general shift in funding costs that represents a longer-term threat to the company’s business model.

Schwab was bleeding deposits well before the banking panic.

As described above, during the last three quarters of 2022 Schwab saw significant deposit outflows totaling some $77 billion. These nearly wiped out the deposit gains the firm saw over 2021 and early 2022. Overall, the company saw $105 billion leave when payables to brokerage clients are included:

The Company’s consolidated Tier 1 Leverage Ratio increased to 7.2% at December 31, 2022 from 6.2% at year-end 2021. This increase resulted primarily from lower bank deposits and payables to brokerage clients, which decreased by a total of $105.3 billion, or 18%, in 2022 due to client cash allocation decisions resulting from the rising interest rate environment….

Schwab has relied on the Dallas FHLB to make up the difference. The bank made ample use of the FHLB lending program to cover the lost deposits. By December 2022, Schwab had $12.4 billion in FHLB loans outstanding, compared with zero FHLB loan balance in the prior year. In the first two months of 2023, Schwab went back to the FHLB to borrow an additional $13 billion, bringing their total FHLB loans to $25.4 billion as of February. These loans carry interest rates near 5%. Notably, Schwab was already the largest borrower from the FHLB in December:

At December 31, 2022, the Bank had advances of $10,000,000,000 outstanding to its largest borrower, Charles Schwab Bank SSB, which represented approximately 14.4 percent of total advances outstanding at that date. In addition, at that same date, the Bank had advances of $2,400,000,000 outstanding to Charles Schwab Premier Bank, an affiliate of Charles Schwab Bank SSB, which represented approximately 3.5 percent of total advances outstanding as of December 31, 2022.

Schwab also used repurchase agreements, in which short-term loans are advanced by other financial institutions against investment securities, to borrow $4.4 billion in 2022. In the first two months of 2023, Schwab used repo agreements to borrow another $3.4 billion. Between FHLB and repos, Schwab reported borrowing $33.2 billion.

Finally, Schwab has gone to the certificate of deposit market to replace lower-interest deposits. Over 2022, Schwab added $6 billion in CD’s. In the first two months of 2023, the firm issued another $9.4 billion in brokered CDs, bringing the total to over $15 billion:

In total, this means that Schwab had raised over $48 billion in combined FHLB advances, repos, and CDs by February 2023.

Schwab depends on interest income for revenue.

Schwab derives a significant portion of its revenue from interest on longer-dated mortgage-backed securities and government debt. In total, interest revenue accounted for slightly more than 50% of Schwab’s net revenues in 2022. Roughly 48% of interest revenue was derived from their AFS and HTM securities assets, which are earning an average rate of <2%.

It’s worth noting that net interest income was the sole driver of revenue growth in 2022:

Average interest rates paid on Schwab’s deposits were a paltry 0.17% over 2022. This compares to average rates of 4.88% on recent FHLB loans, 4.99% on repos, and 4.7% for retail certificates of deposit. In other words, these alternative sources for liquidity cost about 28 times more than Schwab’s lower cost deposits. This is also roughly three times higher than their average yields on both AFS and HTM securities. So, for every $1 of deposits Schwab replaces with higher-cost alternatives, they wipe out over $2.50 worth of interest on their securities holdings.

As of the date of the 10k filing, Schwab had some $48 billion in FHLB loans, repos, and CD’s earning around 4.8%. Assuming this level of borrowing remained stable throughout 2023, this would cost roughly $2.3 billion and eliminates a significant portion of their earnings from their securities portfolio.

It is somewhat difficult to ascertain the contribution of different company units to net income, as Schwab’s 10k doesn’t break operational costs up by segment. However, according to FDIC filings, Charles Schwab SSB (the largest of Schwab’s three subsidiary banks) generated $3.1 billion in net income in 2022. Schwab Premier, the second-largest subsidiary bank, generated another $286 million in net income. If this carries over directly into Schwab’s net income, this means that one third of Schwab’s pretax net income ($9.4 billion) is attributable to these banking units.

It is worth noting that Schwab’s operational costs should remain stable despite these changes in interest rates. Costs will remain the same while a key profit center gets squeezed…

Things have not gotten better since February.

As shown above, Schwab had been bleeding deposits throughout 2022. We don’t have the numbers for Q1 2023 yet, but Schwab’s recent public statements confirm that withdrawals have not abated. Per their press release on March 17:

Client bank sweep cash outflows in February were about $5 billion lower than January and March month-to-date daily average outflows are tracking consistent with February. Importantly, these outflows reflect a continuation of client decisions to reallocate a portion of their cash into higher yielding cash alternatives within Schwab. Based on our ongoing analysis of these trends, we still believe client cash realignment decisions will largely abate during 2023.

This statement is notable for the information it does not include. For example, how did withdrawals in January 2023 compare to withdrawal rates in 2022? If we conservatively estimate January withdrawals were equal to the average over the prior three quarters, Schwab would have lost another $11 billion in deposits. That would put February at $6 billion, meaning another $17 billion fled the bank in the two months prior to the March banking panic.

This is a pretty conservative estimate, as Schwab apparently borrowed some $13 billion in FHLB loans and issued another $9 billion in CD’s through mid-February. This suggests that deposit flight may have been much higher in January than the average rate of withdrawals in 2022.

Schwab also engaged in subtle misdirection in their statement. Schwab shares that they saw “net asset growth” over the week prior to the statement:

Over the past five trading days (3/10/23-3/16/23), clients have continued to bring assets to Schwab, with approximately $16.5 billion in core net new assets for the week, demonstrating the trust clients place in Schwab.

However, this result tells us nothing about deposits, as Schwab holds a wide variety of client assets including securities. Schwab also offers money market funds that could see inflows without providing support for deposits. In the case of cash movements, $1 does not always equal $1…

So that was the situation as of March 17th. How did the rest of March go? According to Schwab’s update on April 6:

Deposit flows at Schwab Bank have remained fairly consistent during this tumultuous period.  In fact, adjusting for modestly increased cash movements during the week last month following national concerns about regional bank stability, the average daily outflows were below February.

The odd wording of this statement (“modestly increased”) raises some concerns that management is trying to prepare the market for bad news in as gentle a fashion as possible. The lack of information in the statement is a warning sign: One might assume that if the detailed numbers were positive, Schwab would be willing to share specifics. Instead, they have chosen to remain as vague as possible while trying to instill confidence in their customers and investors.

So what is next for Charles Schwab?

Schwab will announce their quarterly results on April 17th. At that time, we will discover the extent of the deposit flight over the past three months, as well as the ways in which the company has managed to patch their lost liquidity. Right now, the company seems reliant on short-term fixes for a longer-term problem. We think it is possible that the company will attempt to improve its financial position through debt and/or equity offerings in the near future.

Regardless of the upcoming results, the company’s overall situation remains unchanged. Customers, acting rationally, will continue to seek higher-yielding alternatives as long as interest rates remain elevated. Schwab, in turn, will find itself forced to use high-cost band-aids to patch its liquidity issues. The company finds itself pressed between the rock of higher interest rates and the hard place of a balance sheet stuffed with massive holdings of low-yielding debt.

The only question remaining is: how hard is Schwab going to get squeezed?

Note: We would like to thank one of our readers, @shoykhet_co, for alerting us to the problems underlying the Schwab business model! It is suggestions like these that lead to our best work.

However, soon thereafter media reports surfaced about a possible savior. The stablecoin issuer Circle announced they would be using an obscure privately held New Jersey bank called Cross River to handle payment processing services.

Despite its relatively small size in asset terms, Cross River is a critical player in the financial technology “fintech” world. It also has a longstanding relationship with the cryptocurrency industry. Cross River has taken a somewhat unique approach to banking and has no branches and no tellers. Its focus on rapid growth and willingness to take risks launched it from a tiny bank worth a few million dollars to a multi billion- dollar valuation in a little over a decade.

While this approach has led to success, it has left Cross River tied (perhaps inextricably) to an industry on the brink of failure. At the same time, their focus on rapid growth over due diligence has opened up their bank to accusations of fraud. And despite the recent reports that Cross River will be the crypto world’s new home, it appears the company is actively distancing themselves from the industry.

Cross River grew rapidly by partnering with the fintech industry

Cross River was founded by the company’s current CEO Gilles Gade in 2008 after he and a group of investors bought a small New Jersey bank for about $10 million. After a couple years of minimal activity, in 2010 the firm partnered with the consumer lending “fintech” GreenSky to provide loan origination services.

Greensky specialized in no-interest loans for home improvement. In the post-2008 world of credit, there were few banks willing to take on the risk of making unsecured loans to consumers. However, where most other banks only saw risk, Cross River found opportunity. After this introduction to the fintech industry, Cross River subsequently partnered with a multitude of fintechs offering a variety of financing options to consumers.

In a 2019 Forbes article about the bank, Gade described the strategy this way:

“We’re in the moving business, not the storage business,” booms chief executive Gilles Gade, 53, an immigrant from France, balding and wearing clear-framed glasses and a navy Hugo Boss sweater. “We move assets. We originate [them], we package them, and we sell them.” 

Most “fintechs,” despite the innovative-sounding name, are relatively simple: Fintechs specialize in making the kinds of loans that would typically not interest banks, like small consumer loans to buy individual products. Since these firms don’t have banking charters, they have to rely on outside partners to originate the loans. In most of these deals, Cross River originates the loans and then sells them to the fintech company. From there, the goal is to then sell the loans to third parties like hedge funds and pensions. In many cases, the loans were pooled and securitized.

It is worth keeping in mind that many of these loans are marketed as zero-interest buy now-pay later loans; if these are not paid on time, the interest rates skyrocket into the double digits. This has been criticized by many as a type of predatory lending that skirts individual state laws against usury. Cross River has been sued multiple times for predatory lending practices.

More critically, this model relies on a combination of robust consumer demand, downstream demand from other investors for debt, and low interest rates (to finance fintechs purchasing these loans). As interest rates rose, Cross River’s partners have had a harder and harder time selling the consumer loans to third parties. As the pipeline clogged and backed up, Cross River was left holding the bag. Over the last year, loans held for sale by Cross River more than doubled, from $1.1 billion to $2.3 billion. Individual consumer loans now make up 1/3 of Cross River’s total assets.

This is akin to a retailer having inventory building up on their balance sheet. It is a sign of a deteriorating business model, and as the “buy now, pay later” industry rapidly declines Cross River has been left holding the bag.

Cross River made a fortune from the Paycheck Protection Program… and also a lot of bad loans

After COVID-19 shut down the economy, the federal government stepped in to provide financial support to businesses in the form of forgivable loans to cover employment costs. Cross River saw another opportunity for rapid growth and partnered with several fintechs to mass-produce PPP loans.

Cross River’s PPP business was incredibly successful: By mid 2020, the bank was one of the largest originators of PPP loans:

Cross River has churned out loans to more than 106,000 businesses through the Paycheck Protection Program, a centerpiece of the government’s $2 trillion CARES Act. That puts it just behind three of the country’s most prolific lenders: Bank of America, JPMorgan Chase and Wells Fargo.

The tiny New Jersey bank ended up being the sixth-largest originator of PPP loans in the United States. This led to the bank generating over $1 billion in fees according to Bloomberg. However, the bank’s loan quality was more questionable. Cross River placed most of the burden for due diligence on their fintech partners, and a large proportion of loans turned out to be entirely fraudulent. One warning signs was the loan forgiveness rate: Cross River’s forgiveness rate trailed far behind most competitors, suggesting many applicants failed to meet the criteria for forgiveness.

By mid-2021, Cross River’s PPP loans were facing increasing scrutiny in the media. The initial reports of possible malfeasance were confirmed by a December 2022 report from the Small Business Administration. Notably, some 30% of federally-prosecuted PPP loan frauds were attributable to just two banks:

An investigation from the Project on Government Oversight found that Cross River Bank and Celtic Bank were involved in 30% of the Justice Department's fraudulent PPP loan prosecutions.

According to a May press release from the House subcommittee, Cross River Bank approved more than 280,000 PPP loans, worth over $6.5 billion, and Celtic Bank funded nearly 100,000 PPP loans, which totaled more than $2.5 billion.

In April 2020, Cross River's chief risk officer said in an email to staff: "There will be fraud rings going after these [PPP] funds." In October 2020, the CEO of Celtic Bank wrote in an email that the high level of fraud was "not surprising" because of the program's guidelines.

As a consequence, the SBA announced that it was launching a formal investigation of Cross River and several other banks:

In addition to the actions announced today, SBA launched a full investigation of the lenders -- Benworth, Capital Plus, Celtic Bank, Customers Bank, Cross River Bank, Fountainhead, Harvest, and Prestamos -- as well as the individuals and other related entities named in the report.

As a consequence, the SBA has refused to pay Cross River some $300 million in funds related to the PPP loans. It will be interesting to see how the SBA investigation turns out for Cross River Bank…

Cross River was all-in on crypto… until recently

In addition to its ostensibly technology-friendly attitude, Cross River has had a long association with cryptocurrency. Its early partnership with Coinbase started the relationship between the bank and the crypto industry:

“Crypto has been the darling of Cross River for eight years,” Gade told TechCrunch. “It started with our relationship with Coinbase as a loyal provider of banking integration, crypto to fiat and fiat to crypto onboarding for their customers.”

Cross River aggressively marketed its crypto-related services, including at one point offering loans backed by cryptocurrency collateral.

Cross River’s crypto-friendly attitude may have something to do with its venture capital backers. In 2016, the bank completed a successful VC funding round for $28 million led by Andreeson Horowitz (A16Z), Ribbit Capital and Battery Ventures. In subsequent rounds the bank raised a total of $908 million, with A16Z being a key investor throughout.

However, despite news reports suggesting Cross River remains committed to crypto, their recent actions suggest otherwise. The bank stopped offering crypto-backed loans in 2022, and we noted that the bank recently scrubbed most of the references to crypto off of their website:

Conclusion: Another troubled bank takes big risks… and now faces the consequences

While banks are generally expected to be conservative and risk-averse, the recent banking crisis has exposed some of the questionable practices in the industry. Banks like Signature and Silicon Valley took on the significant risks of holding large uninsured deposits that were likely to flee at the first sign of trouble. Both Silvergate and Signature chose to do business with problematic and potentially criminal customers, a decision that contributed to the failure of both institutions.

Cross River Bank embodies the “growth at all costs” ethos that dominates Silicon Valley. While this approach led to initial success, Cross River now finds itself embroiled in multiple legal battles and has been left holding the bag on a mountain of unwanted consumer debt.

The bank may have learned a lesson about the double-edged sword of risk and reward, as it appears they are abandoning the crypto industry in the face of widespread regulatory pressure and negative public perception. And if even Cross River Bank doesn’t want to do business with crypto companies anymore… who will?

On March 27th, the Commodities and Futures Trading Commission (CFTC) filed a civil lawsuit against the Binance cryptocurrency exchange. The suit alleges that Binance broke a multitude of U.S. laws by allowing U.S. customers to access and use their trading platform. Additionally, the CFTC alleges that Binance engaged in market manipulation, fraud, and flagrant violations of laws against money laundering.

The CFTC is limited to civil enforcement actions. However, the CFTC lawsuit contains damning evidence of criminal activity on the part of Binance, CEO Zhao, and their chief compliance officer Samuel Lim. The CFTC suit includes liberal quotes from messages between Binance employees and even asserts that the agency has gained direct access to Mr. Zhao’s cell phone. We assume this evidence has been made available to criminal enforcement agencies like the Department of Justice.

Unfortunately, it does not seem like Binance executives were fans of The Wire, which provided some excellent instructions about what not to do when operating an illegal enterprise:

Based on the evidence advanced by the CFTC , as well as evidence shared by various media outlets, we believe it is a matter of time before key Binance executives face criminal prosecution. Given that this lawsuit reads like a “best hits” compilation of some of Binance’s most egregious behavior, it is worth reading in full. However, for now let’s take a look at some of the highlights.

Binance flouted KYC/AML laws: “Do a half-assed” job

The CFTC suit contains multiple examples of Binance’s lax approach to know-your-customer/ anti-money launder (KYC/AML) rules. For example (emphasis added):

"But according to Lim, Binance purposely engaged a compliance auditor that would “just do a half assed individual sub audit on geo[fencing]” to “buy us more time.” As part of this audit, the Binance employee who held the title of Money Laundering Reporting Officer (“MLRO”) lamented that she “need[ed] to write a fake annual MLRO report to Binance board of directors wtf.” Lim, who was aware that Binance did not have a board of directors, nevertheless assured her, “yea its fine I can get mgmt. to sign” off on the fake report. Around the same time as the referenced “half assed” compliance audit, in November 2020 the MLRO exclaimed to Lim in a chat, “I HAZ NO CONFIDENCE IN OUR GEOFENCING.”

Binance also knowingly provided services to clients with ties to darknet markets like Hydra, letting them off with warnings to be more careful:

Lim’s internal discussions with compliance colleagues illustrate that Binance has tolerated Binance customers’ use of the platform to facilitate “illicit activity.” For example, in July 2020, a Binance employee wrote to Lim and another colleague asking if a customer whose recent transactions “were very closely associated with illicit activity” and “over 5m USD worth of his transactions were indirectly sourced from questionable services” should be off-boarded or if it was in the class of cases “where we would want to advise the user that they can make a new account.” Lim chatted in response: “Can let him know to be careful with his flow of funds, especially from darknet like hydra. He can come back with a new account, but this current one has to go, it’s tainted.”

Remember, you are reading the messages of BINANCE’S CHIEF COMPLIANCE OFFICER. Seems he was quite compliant… with the orders of his boss, CZ:

In a January 2019 chat between Lim and a senior member of the compliance team discussing their plan to “clean up” the presence of U.S. customers on Binance, Lim explained: “Cz doesn’t wanna do us kyc on .com.”

The evidence provided by the CFTC matches reports that Binance has facilitated money laundering for various criminal actors in the past. In particular, we note the Justice Department’s recent prosecution of the Russian crypto exchange Bitzlato identified Binance as the top counterparty of that criminal entity.

Indeed, Mr. Lim and colleagues had this to say about terrorists using the Binance platform:

For example, in February 2019, after receiving information “regarding HAMAS transactions” on Binance, Lim explained to a colleague that terrorists usually send “small sums” as “large sums constitute money laundering.” Lim’s colleague replied: “can barely buy an AK47 with 600 bucks.”

And with regard to certain Binance customers, including customers from Russia, Lim acknowledged in a February 2020 chat: “Like come on. They are here for crime.” Binance’s MLRO agreed that “we see the bad, but we close 2 eyes.”

Binance illegally operated in the United States: “Teaching ppl how to circumvent sanctions”

The CFTC demonstrates that Binance has offered services to both retail and institutional clients based in the United States for several years. This policy was enacted despite CZ knowing full well that Binance was breaking the law:

For example, Zhao explained during a June 9, 2019 management meeting:

[T]here are a bunch of laws in the US that prevent Americans from having any kind of transaction with any terrorist, and then in order to achieve that, if you serve US or US sanctioned countries there are about 28 sanctioned countries in the US you would need to submit all relevant documents for review [but that is not] very suitable for our company structure to do so. So, we don’t want to do that and it is very simple if you don’t want to do that: you can’t have American users.

From the early days, chief compliance officer Lim was well aware of the dangers of offering illegal services to U.S. customers:

…in a December 2018 chat, Lim acknowledged that Binance was operating “in the USA” and advised his colleagues that “there is no fking way in hell I am signing off as the cco for the ofac shit.” In that same chat, Lim recognized that Binance’s customer support was “teaching ppl how to circumvent sanctions.” And Lim stated in an October 2019 chat: “the ofac regulation clearly states U.S. persons, doing biz with OFAC is wrong,” but clarified that Zhao desired to place competitive advantage over compliance: “thing is [Zhao] will only agree to block US on .com once US exchange has gotten all [money transmitter licenses] (to match [a U.S.-based digital asset exchange]).”

Binance used several approaches to offer services to U.S. customers. For smaller clients, Binance created “no KYC” accounts that placed a limit of two bitcoin/day worth of withdrawals. Binance encouraged U.S. customers to transition to this account type to continue to use the platform. Binance also encouraged customers to use virtual private networks (VPNs) to evade the platform’s own controls. Binance went so far as to create a guide for how to use a VPN. Mr. Lim himself admitted the guide was created to help customers:

In a March 2019 chat, Lim explained to his colleagues that “CZ wants people to have a way to know how to vpn to use [a Binance functionality] . . . it’s a biz decision.” And in an April 2019 conversation between Binance’s Chief Financial Officer and Lim regarding Zhao’s reaction to controls that purported to block customers attempting to access Binance from U.S.-based IP addresses, Lim said: “We are actually pretty explicit about [encouraged VPN use] already – even got a fking guide. Hence CZ is ok with blocking even usa.”

When an employee asked Lim how to retain one particular U.S. based customer, he said this in response:

No we cannot change their status to non us if they are us. Thats fraud. But we can encourage them to be a non kyc account. Or use a vpn. Yea can bypass [limitations on non-KYC accounts, such as withdrawal limits], give a little hand. that you guys can work something out. plase be clear we only do this for our biggest traders/VIPs… this is SPECIAL treatment.

Binance had a different approach for its larger, “VIP” trading clients. For these special customers, Binance told them to create offshore shell companies and then transfer their old U.S.-based accounts to the new shellco:

Binance personnel began assisting U.S. VIP customers in creating “new” accounts using “new” KYC documentation as early as June 2019, and reported directly to Zhao on their efforts. For example, in a Binance group chat dated June 12, 2019, a Binance employee directed the following message to “@czhao,” which is a handle used by Zhao:

Today our VIP team talked with three VIP8 users, we didn’t talk too much details and they all satisfied that we can help them onboarding their new non-US corporate accounts. That’s a good start, we’ll contact more VIPs tmr.

Zhao responded in the same chat: “cool.”

The CFTC provides evidence that CZ himself directed these activities:

On October 9, 2020, around the time Binance began sending emails to U.S. customers pursuant to the policy, Zhao had the following exchange with an employee who would ultimately become Binance’s head of institutional sales:

VIP team member: Hi CZ . . . I went through list of affected API clients, it includes a number of large strategic accounts including [a Chicago-headquartered trading firm] who is currently is a top 5 client and 12% of our volume

Zhao: Give them a heads up to ensure they don’t connect from a us Ip. Don’t leave anything in writing. They have non us entities. Let’s also make sure we don’t hit the biggest market makers with that email first. Do you have signal?

“Don’t leave anything in writing”… maybe CZ is a Stringer Bell fan after all?

Binance traded against its own customers: “House accounts”

It has been reported previously that Binance operated its own affiliated market making services on their exchange. However, the CFTC revealed that Binance operates “approximately 300 ‘house accounts’” that trade against Binance users.

In response, Binance admitted to trading on the platform with the following self-contradictory statement:

Binance.com does not trade for profit or “manipulate” the market under any circumstances. Binance “trades” in a number of situations. Our revenues are in crypto. We do need to convert them from time-to-time to cover expenses in fiat or other crypto currencies. We have affiliates that provide liquidity for less liquid pairs. These affiliates are monitored specifically not to have large profits.

Mhm. According to the CFTC:

On information and belief, Binance has not subjected the trading activity of Merit Peak, Sigma Chain, or its approximately 300 house accounts to any anti-fraud or antimanipulation surveillance or controls and to the extent Binance purports to have required its officers, employees, and agents to abide by a relatively new “insider trading” policy, Binance’s approximately 300 house accounts are exempt from that policy.

We have to wonder what percentage of Binance’s daily trading volumes might be accounted for by these 300-odd accounts…

Conclusion: Time is running out for ol’ CZ and the gang…

Now, as we mentioned at the start of this article, the CFTC is a civil enforcement agency. While they will likely extract large fines from Binance and finally prevent them from doing business in the United States, it is unlikely that their actions would be a death blow to CZ’s empire.

However, we note that the evidence cited above (in addition to substantially more information we did not share) suggests a multitude of severe criminal violations. When read in the context of public reports about Binance laundering money for criminals, evading sanctions, conspiring to evade U.S. securities laws, and other violations, it seems clear to us that criminal indictments are quite likely.

We also note an interesting detail from the CFTC lawsuit:

Zhao has communicated over Signal with the auto-delete functionality enabled with numerous Binance officers, employees, and agents for widely varying purposes. For example, the following Signal text chains or group chats collected from Zhao’s telephone were among those set to auto-delete…

Wait… how did the CFTC get ahold of CZ’s phone? Is it possible that there is a rat on Binance’s pirate ship? Maybe it has something to do with the ongoing Department of Justice investigation into Binance?

All we can say is:

Good luck, CZ. You’re going to need it!

Disclaimer: We are short COIN… and should have finished this article yesterday! Nothing in this article should be taken as individual financial advice or an inducement to make any investment decision. Full disclosure at bottom of this post.

Coinbase is a cash-burning machine projected to lose money for at least the next two years

Coinbase’s business model is simple: Selling people various unregistered investment schemes and taking a commission off the top. In 2021, this business model was quite successful, with the firm growing revenue over 600%. The company earned $3.6 billion in net income. Things did not go nearly as well for Coinbase in 2022. With the crypto market peaking and then deflating, the company saw massive declines in revenue. They ended the year with a net loss of $2.6 billion.

With 2023 shaping up to be a hellish year for even the legitimate economy, we struggle to see how Coinbase’s financial condition will improve. Indeed, analysts agree with our assessment and project significant losses for Coinbase in both 2023 and 2024.

Coinbase’s net income doesn’t capture another major expense: stock-based compensation. Over the past two years, Coinbase paid over $2.3 billion worth of employee compensation via stock. Of course, one solution to the problem of compensation is by cutting staff, with Coinbase announcing they planned to cut approximately 20% of their workforce (950 employees) in January 2023.

So Coinbase is a shrinking business expected to lose money for at least the next two years WITHOUT any significant changes to its business model. And guess what? These obvious financial issues are only the icing on top of more foundational concerns. It turns out that Coinbase’s entire business model is at risk of annihilation at the hands of regulators…

Coinbase faces direct regulatory risks that may be existential threats to its business

Coinbase partially compensated for the 2022 collapse in transaction fees by growing their crypto staking business. “Staking” crypto enables investors to generate returns by locking their tokens into various platforms. Unfortunately, the SEC does not take kindly to this type of activity. The U.S. crypto exchange Kraken recently paid a $30 million fine and ceased offering all staking products after settling with the SEC for offering similar services to Coinbase. However, Coinbase has chosen to keep offering these services, essentially daring the SEC to come after them for the offering:

However, this is how Coinbase describes staking on its website:

Staking serves a similar function to mining, in that it’s the process by which a network participant gets selected to add the latest batch of transactions to the blockchain and earn some crypto in exchange. Stakers also help establish which blocks are valid….

Many long-term crypto holders look at staking as a way of making their assets work for them by generating rewards, rather than collecting dust in their crypto wallets.

To us, this sure seems like an investment contract, right? Coinbase acts as the intermediary for its staking customers, taking a fee off the top for offering these services. For reference, this is how the SEC defined an investment contract in its recent lawsuit against Tron founder Justin Sun (more on that shortly):

An investment contract, for purposes of the Securities Act, includes any “contract, transaction or scheme whereby a person invests his money in a common enterprise and is led to expect profits” from the efforts of others. This broad definition is “flexible” and “capable of adaptation to meet the countless and variable schemes devised by those who seek the use of the money of others on the promise of profits.”

Coinbase, however, argues that their service does not meet these criteria and has threatened to sue the SEC to prove this point.

Coinbase faces other direct regulatory headwinds at both the state and federal levels. Coinbase recently settled with the State of New York for flagrant compliance violations, paying a $50 million fine and agreeing to invest another $50 million in improved compliance. With scrutiny on the crypto-conomy reaching a fever pitch, Coinbase may face similar actions in the coming months.

The company has long exhibited an antagonistic attitude towards regulators. At one point, their CEO Brian Armstrong called the SEC “sketchy” in a long thread complaining about a supposed lack of regulatory clarity:

Armstrong’s attitude displays the broader cognitive dissonance displayed by crypto-conomy advocates. They argue that there is “no regulatory clarity,” therefore it is fine for them to offer whatever investment products or services they please. They argue that the “innovative” components of their investment products (i.e., listing things on a decentralized ledger) means that these products don’t fall into traditional regulatory categories and require special treatment.

However, the SEC has an understandably different view: that crypto tokens, despite being issued using a blockchain, neatly fit the well-established definition of a security. The SEC has made this stance publicly clear for some time, with SEC Chairman Gary Gensler stating that most crypto tokens are securities:

"Whatever they're promoting and putting into a protocol, and locking up their tokens in a protocol, a protocol that's often a small group of entrepreneurs and developers are developing, I would just suggest that each of these token operators ... seek to come into compliance, and the same with the intermediaries,” Gensler said.

The SEC just announced legal action against the Tron (TRX) cryptocurrency token issued by the infamous Justin Sun. In this action, the SEC alleges market manipulation by Sun and asserts that Tron is a unregistered security due to its “proof of stake” mechanism. This assertion applies to many other crypto tokens currently offered in the crypto-conomy, meaning many more enforcement actions could be on the way.

The SEC isn’t the only regulatory agency asserting that cryptocurrencies are securities. In a recent lawsuit against the KuCoin crypto exchange, New York Attorney General Letitia Jones asserted that the second-largest cryptocurrency, Ether, is also a security due to its “proof-of-stake” validation mechanism, its promotion as an investment by the Ethereum Foundation, and its initial issuance via an “initial coin offering.”

How big of a problem might this be for Coinbase? According to Coinbase’s 10K:

For the years ended December 31, 2022 and 2021, we derived a meaningful amount of our net revenue from transaction fees generated in connection with the purchase, sale, and trading of Bitcoin and Ethereum; these trading pairs drove approximately 55% and 45% of total Trading Volume on our platform during these periods, respectively.

In other words, >45% of Coinbase’s trading volume in 2022 was in crypto tokens other than Bitcoin. This suggests that a regulatory crackdown on Ethereum or other smaller crypto tokens could have a devastating effect on Coinbase’s revenue and overall business model.

Coinbase received a Wells Notice regarding incoming enforcement actions related to several aspects of its business

It looks like Coinbase will be getting their day in court: as we were putting the finishing touches on this piece, Coinbase disclosed that they had received a Wells notice from the SEC threatening enforcement actions against multiple aspects of their business including their spot markets and staking offerings.

This is Very Not Good for Coinbase. Coinbase has insisted they will continue to operate in the same manner after they receive the formal enforcement actions related to this notice. However, they will be forced to choose between two unfavorable responses. Either they can settle with the SEC and radically alter their entire business, or they will be embroiled in lengthy legal battles that appear (to us) to likely end in the regulators’ favor.

Coinbase faces other indirect regulatory risks that may be existential

Coinbase’s business model faces major downsides in the event of legal action against industry-dominating firms like Binance and Tether. Coinbase itself has at several points called the legitimacy of both firms into question. For example, Coinbase told its clients to swap out their Tether stablecoins for Circle’s USDC stablecoin, suggesting that Tether is not a trustworthy entity.

Ironically, USDC itself recently had a brush with insolvency last week when Silicon Valley Bank went down…

We note that there is substantial public evidence that both the largest stablecoin (Tether) and the largest crypto exchange (Binance) are active targets for regulators and criminal investigators. Should either of these entities face criminal prosecution or significant regulatory action that prevents them from doing business, broader crypto markets will face potential devastation.

Coinbase does a very good job of explaining how fraud in the crypto ecosystem could destroy their business:

Further, in 2022, a number of blockchain protocols and crypto financial firms, and in particular protocols and firms involving high levels of financial leverage such as high-yield lending products or derivatives trading, suffered from insolvency and liquidity crises leading to the 2022 Events. Some of the 2022 Events are alleged to be the result of fraudulent activity by insiders, including misappropriation of customer funds and other illicit activity and internal controls failures….

Forced selling by distressed companies may also depress the prices of assets used as collateral by other firms. If this market condition becomes widespread in the cryptoeconomy, including as a result of the 2022 Events, we may suffer from increased counterparty risk, including defaults or bankruptcies of major customers or counterparties, which could lead to significantly reduced activity on our platform and fewer available crypto market opportunities in general. Further, forced selling of crypto assets by distressed companies could lead to lower crypto asset prices and a consequent reduction in our revenue.

In other words: Coinbase’s future may rest entirely outside of the company’s control!

Conclusion: No risk of bankruptcy, guys. Promise!

It is certain that Coinbase faces substantial threats to its business in the coming months. We do note that the company has certain advantages. For example, the company has a good reputation in the crypto industry. We also have not discovered any evidence suggesting the company is actively engaged in fraud or malfeasance with customer assets. Coinbase also has a significant amount of cash that will allow them to weather the possible collapse of their industry.

And most importantly, Mr. Armstrong himself has assured everyone that there is no risk of bankruptcy for Coinbase:

We will breathe a sigh of relief and trust that you are right, Brian!

*The use of this research is at your own risk. We are not liable for any losses, direct or indirect, caused by any information in this report. You agree to perform your own due diligence and consult your own expert advisors before making any investment decisions related to the securities mentioned in this article. The author has a short position in Coinbase via put options. We may continue to transact in this security after publishing this report. This post is not offering to sell or soliciting an offer to buy any securities. We are not investment advisors and nothing in this post should be considered investment advice. The information contained herein was obtained from public sources including regulatory filings, social media posts, and third party news outlets. To the best of our knowledge, ability and belief, we believe this information is accurate. However, we cannot guarantee the accuracy of this information and as such it is presented “as is,” without any express or implied warranty.

Disclosure: We were short Signature Bank prior to its collapse, primarily due to concerns that will be described in this piece.

On March 13, the New York Department of Financial Services (NY DFS) announced they had removed management and placing it under the control of the FDIC:

Superintendent Adrienne A. Harris announced today that the New York Department of Financial Services (DFS) has taken possession of Signature Bank, pursuant to Section 606 of New York Banking Law, in order to protect depositors. DFS appointed the Federal Deposit Insurance Corporation (FDIC) as receiver of the bank. 

The sudden collapse of Signature shocked everyone, even us. Despite being short the bank for close to a year, we thought that an outright failure was unlikely. In our conversations with traders, fund managers, analysts, and journalists, the consensus was that Signature faced significant financial headwinds and regulatory problems. Not one person we spoke to thought that the bank would go to $0.

So what happened?

Signature’s deposit characteristics placed it at high risk for failure

However, few people expected the series of events that unfolded over the last week. Unlike Silicon Valley Bank (SVB), Signature did not have outsized unrealized losses on their balance sheet hidden in “held-to-maturity” assets. However, Signature did have an abnormally high percentage of deposits over the FDIC-insured limit:

You will note that several of the other banks with high uninsured deposits, like First Republic (FRC), Western Alliance (WAC), and Zion are also on watch lists for possible failure. FRC in particular received a $30 billion deposit infusion from multiple large banks to shore up their balance sheet; however, there is still significant concern that FRC may go under in the coming days.

Like SVB, Signature faced a run on deposits both from its crypto and non-crypto clients. With close to 90% of its deposits over the FDIC-insured limit, customers were incentivized to run for the exits when public concern rose over the bank’s financial condition. The bad news surrounding the bank and its role in the FTX scandal had already tarnished its reputation. After the failure of crypto-focused Silvergate Bank on March 8, depositors began to move for the exits. This rapidly accelerated as Silicon Valley Bank began to falter.

Signature had about $4.5 billion in cash on hand as of March 8th and $89 billion in deposits. According to Bloomberg, Signature had approximately 20% of its deposits withdrawn on Friday the 10th, with withdrawal requests piling up over the weekend:

… the DFS described “significant withdrawal requests still pending and mounting” through the weekend.

Signature lost 20% of its deposits on Friday, as clients spooked by the collapse of SVB Financial Group’s banking unit fled to larger competitors, the person familiar with the matter said.

The person, who asked not to be identified discussing a private matter, didn’t provide exact figures for how much left the bank. But Signature said in a statement Thursday that it held roughly $89.2 billion in deposits as of March 8. That would suggest approximately $17.8 billion was pulled in a single day. “

Of course, these are estimates and don’t include whatever funds were withdrawn on Thursday as the panic over Silicon Valley was mounting. We also don’t know how much in withdrawal requests piled up over the weekend prior to the shutdown.

After the failure, contradictory explanations appeared in the media…

There have been conflicting stories about the bank’s seizure, which has led to significant controversy. It turns out that one of the bank’s directors is none other than Barney Frank, the co-author of the Dodd-Frank reforms enacted after the 2008 financial crisis. Immediately after the bank failed, Mr. Frank took to the media to claim that Signature was financially sound and likely would have survived the coming onslaught of withdrawals had they been allowed to open on Monday:

“By Sunday morning, the executives of the bank believed they had satisfied the need for the data and had secured the capital from the discount window and elsewhere,” Frank said.

Mr. Frank also sparked significant consternation with his claim that the bank was shut down due to its crypto-friendly business practices:

The regulators “wanted to send a message to get people away from crypto,” Frank said in a Bloomberg radio interview Monday. “We were singled out to be the poster child for that message.”

However, the NY DFS denied this claim, stating that they had taken control due to a loss of confidence in management after they “failed to provide consistent and reliable data” as the run on deposits progressed.

Crypto advocates have taken to social media to assert that Signature’s takeover was part of an “Operation Choke Point 2.0.” According to these folks, the government is illegally pushing banks to stop doing business with crypto firms for no good reason. Even the Wall Street Journal opinion page got in on the action, wildly suggesting that the takeover was a “crypto execution.” Again, the only evidence they cite is Mr. Frank’s claims. In turn, Barney based his claims on information he received from Signature management.

So, was the takeover legitimate? And why did it happen? While we still don’t know for certain, an examination of the facts and laws involved in this situation can lead us to some reasonable possible answers.

One obvious possibility is that Signature Bank was insolvent, despite executive’s statements to Mr. Frank. If the bank was unable to make good on withdrawal requests and was poised for failure, regulators would have an obvious reason to step in. Recent revelations suggest that Signature’s real estate loan portfolio may have been more distressed than disclosed by management. This agrees with data we had obtained prior to their collapse showing that a predominance of their loans were on class C properties and often involved questionable landlords. The coming bidding process for Signature will hopefully shed more light on their financial condition.

However, New York state law describes a number of scenarios in which a bank may be taken over even if the bank is not insolvent:

The superintendent may, in his discretion, forthwith take possession of the business and property of any banking organization whenever it shall appear that such banking organization:

(a) Has violated any law;

(b) Is conducting its business in an unauthorized or unsafe manner;

(c) Is in an unsound or unsafe condition to transact its business;

…(h) Has refused, upon proper demand, to submit its records and affairs for inspection to an examiner of the department…

Criteria (h) may be the closest fit with regulators’ official statements on the seizure, as they have indicated that management failed to provide timely and accurate infomation about their financial condition. Again, this reason alone would be sufficient to satisfy legal requirements for removing management.

But, what if regulators are being deceptive, and something about Signature’s crypto business contributed to their decision? A straightforward reading of these rules demonstrates that regulators still would have been acting appropriately:

Whenever it shall appear that such banking organization has violated any law

Over the past few months, we and others shared substantial evidence suggesting that Signature Bank may have facilitated illegal activities in the cryptocurrency space. Notably, some of our assertions were backed up by a class action lawsuit filed against Signature in February for their role in the FTX fraud. In the initial filing, the plaintiff Statistica Capital explains how Signature’s know-your-customer/ anti-money laundering (KYC/AML) procedures would have alerted them to serious problems at FTX and Alameda:

As a result of carrying out its enhanced due diligence obligations… Signature knew at least the following facts, from which it had actual knowledge of the fraud:

a.There was no real separation between Alameda and FTX.Signature knew the fine details of both entities’ corporate formations, beneficial owners, management, operations, and organizational structure….

b.Alameda played a vital role in the operation of FTX….

d.Alameda and FTX lacked adequate corporate formalities…

e.Alameda and FTX lacked appropriate personnel and procedures.

Both our work and this class-action suit shared specific concerns about possible misuse of Signature Bank’s “Signet” private blockchain. The Signet blockchain functioned as an internal mechanism for 24/7/365 intrabank transfers between approved customers. The Signet blockchain was an integral piece of Signature’s crypto services and was essential for real-time settlements, particularly in the management of stablecoin reserves.

The plaintiff asserts that FTX directed them to deposit funds via the Signature Bank Signet blockchain, and that Signature employees assisted the plaintiff in connecting their Signet account to FTX’s. However, it turns out that only Alameda Research held a Signet account per FTX bankruptcy filings. Signature confirmed this fact after FTX’s collapse.

Statistica Capital asserts that they lost $300,000 as a consequence:

Since Alameda, FTX, and related entities entered bankruptcy on November 11, 2022, Statistica Capital and its majority owner have been unable to recoup $300,000 intended for FTX but actually sent or diverted to Alameda via Signet.

In other words, the combined evidence suggests that Signature knowingly allowed commingling of funds between Alameda via Signet. This is, to put it mildly, a problem.

Signature also banked another critical element of the FTX conglomerate, the Hong Kong OTC crypto exchange Genesis Block. As we and others have shown, Genesis Block (another ostensibly separate entity) processed potentially billions of dollars in crypto transactions, much of it for “garbage bags full of cash.” Genesis Block OTC was a confirmed customer of Signature and also had a Signet account. We have confirmed at least one former Genesis Block customer received wire transfers from Signature Bank to execute crypto purchases.

Outside of the FTX fraud, Signature collected a laundry list of other bad actors in the crypto space despite their allegedly strict KYC practices. Most notably, that list includes Binance’s Seychelles-based shell corporation Key Vision Development. Signature ended up debanking Binance shortly before their collapse.

In sum, a substantial amount of publicly available information suggests that Signature Bank may have broken the law. One should note that, per the NY state banking laws, the superintendent could seize the bank for “the appearance” of illegal activity.

Also of note: Shortly after Signature failed, Bloomberg reported that Signature Bank was under investigation by the Department of Justice. Based on their reporting, the DOJ’s concerns are remarkably similar to our own:

Justice Department investigators in Washington and Manhattan were examining whether the New York bank took sufficient steps to detect potential money laundering by clients — such as scrutinizing people opening accounts and monitoring transactions for signs of criminality, the people said.

Whenever it shall appear that such banking organization is conducting its business in an unauthorized or unsafe manner

The NY DFS approved Signature’s Signet blockchain in 2021 with certain provisions pertaining to its implementation and operation, including:

The approval is based on stringent requirements including to:

Implement, monitor and update effective risk-based controls and appropriate BSA/AML and OFAC controls to prevent money laundering or terrorist financing.

Implement,monitor and update effective risk-based controls to prevent and respond to any potential or actual wrongful use of virtual currency, including but not limited to its use in illegal activity, market manipulation, or other similar misconduct….

Comply with DFS’s transaction monitoring and cybersecurity regulations.

Maintain policies and procedures for consumer protection and to promptly address and resolve customer complaints.

Based solely on the public information about FTX’s use of Signet services, a reasonable case can be made that Signature had violated key features of this agreement. This would mean that Signature was no longer conducting its business in an authorized fashion.

One can also make the case that Signature was conducting business in an unsafe manner. In January, the Federal Reserve, FDIC, and Office of the Comptroller (OCC) made a joint statement about the risks of offering banking services to the crypto industry. The regulators indicated that:

Further, the agencies have significant safety and soundness concerns with business models that are concentrated in crypto-asset-related activities or have concentrated exposures to the crypto-asset sector.

In other words, federal regulators had clearly stated in January that banks like Signature were engaged in unsafe and unsound banking practices. It would be reasonable for the NY DFS to agree with this assessment considering recent events!

Conclusions: No conspiracies needed to explain the seizure of Signature Bank

We have laid out several possible explanations for the NY DFS taking control of Signature Bank last Sunday. Due to the current lack of information, these are conjectures until more details are made public. Despite the wild accusations currently running through the crypto world about the collapse of Signature, there are plenty of reasonable and legal explanations for this decision.

So what comes next? According to recent reports, the FDIC was seeking bids for Signature Bank that were due March 17th. The bidding process has caused controversy as well after Reuters initially reported that the FDIC would require bidders to “give up” Signature’s crypto business components. The FDIC subsequently contradicted this reporting. However, we would not be suprised if most bidders are uninterested in acquiring this component of the bank’s portfolio….

While Bernie Madoff gets the credit for operating the largest Ponzi scam in history, his “success” did not occur in a vacuum. Unlike many other Ponzi scammers, Bernie generally didn’t directly solicit funds from investors. Instead, he outsourced this work to upstream “feeder funds” that recruited investors, pooled the funds, and sent the money to Bernie to work his magic. In return, these feeder funds took a percentage of the yield paid out by Madoff. This was a lucrative business, with the upstream funds earning millions of dollars in returns for doing very little work. For example, one of Madoff’s biggest feeder funds, Fairfield Greenwich Capital, transferred over $4 billion to Madoff and earned hundreds of millions of dollars in fees in the process.

Things worked great for the Madoff feeders until the Ponzi collapsed. These funds were then sued by investors arguing the funds should have recognized Madoff was running a fraudulent enterprise.

Like the Madoff scheme, the interlinked Ponzi and pyramid scams that dominate the crypto-conomy have benefitted from the activities of similar feeder funds. In several instances, crypto firms that offered yield-paying crypto deposits were outsourcing fund management to other downstream firms that subsequently collapsed. One prominent example was the Canadian crytocurrency exchange and lending firm Voyager Digital. Voyager offered an “Earn” account to customers, then pooled the funds and lent large amounts to companies like Celsius Network and the hedge fund Three Arrows Capital. While Voyager managed to escape the Celsius fraud before its collapse, the company collapsed after its massive bet on Three Arrows Capital went bad.

Another smaller example is the Indiana-based firm Sarson Funds, Inc. We originally encountered this firm over a year ago after a Twitter run-in with the company’s founder and CEO, John Sarson. Mr. Sarson had responded to a post in which we questioned whether certain transfers of the CEL token were suspect. Things escalated, and at the end of the exchange Mr. Sarson requested that we write about him and his business practices:

Almost a year later, we had forgotten about Mr. Sarson until we accidentally happened on another Twitter post of his, admitting to losing money in the Celsius Network collapse.

So, this article was written to keep our promise to Mr. Sarson. However, the story of Sarson Funds provides an excellent context for understanding how the crypto-conomy’s interlinked scams have fed into one another… and how contagion from one firm’s collapse can bring down the entire house of cards.

Founded in 2017, the company is led by John Sarson. Accordingt to LinkedIn, Sarson was previously a “Sales Specialist” at BNY Mellon and a “Regional Vice President” for Guggenheim. In 2016, he struck out on his own to create his own investment firm called ETF Momentum Investing. For some reason, it seems selling ETFs didn’t work out well for Mr. Sarson and he rapidly pivoted to the fast-paced world of cryptocurrency, founding Sarson Funds in 2018.

Using the motto “Real. Clear. Crypto,” Sarson Funds offers multiple services. Sarson Funds, Inc. acts as a marketing arm selling accredited investors a variety of limited partnership cryptocurrency “strategies” managed by Sarson’s team. Sarson also sells a cryptocurrency education course for investment advisors and provides free educational resources. Finally, Sarson offers its own “digital asset consulting” services to new projects, promising to “help bring crypto projects to Wall Street.”

Unfortunately for the team at Sarson Funds, and for their investors, things have not gone so great over the last year. Let’s take a look at a few examples of the risks of being a feeder fund for the biggest scams in crypto.

One of the fund offered is Sarson’s Stablecoin Index, LP. This vehicle invests in a pool of different stablecoins which are then deposited into various yield-generating schemes. Sarson Funds has consistently misrepresented aspects of this fund. For example, their website describes the stablecoins in the fund as:

… cryptocurrency tokens that are specially designed to have a 1:1 corresponding investment in US Dollars, known as “stablecoins.”

This is a bold-faced lie, as most of the coins in the fund are not backed directly by US dollars. The most reputable tokens in the fund are backed by a combination of dollars and other securities, like Treasury bonds. This lie is particularly egregious because 40% of the fund is invested in “algorithmic” stablecoins like DAI, mUSD, and FRAX. These tokens are backed by other cryptocurrencies and do not directly hold either real currency or securities. One of the primary stablecoins held by Sarson was the Terra algorithmic stablecoin UST, which collapsed in May 2022. It is unclear if Sarson took losses during the collapse of Terra or managed to escape that Ponzi in time.

Sarson Funds also makes the false claim that these stablecoins are all “regulated by OECD 20 countries.” In general, stablecoins operate outside of regulatory oversight and are now being targeted by the SEC and other agencies. Again, this claim is particularly egregious when one considers the algorithmic stablecoins on Sarson Funds’ books, as these are entirely unregulated and decentralized.

The Stablecoin Index was originally “powered by Celsius Network.” As of March 2022, 40% of the fund was deposited in Celsius Network. Like Madoff’s feeder funds, Sarson then sat back and took a cut off the top of the yield paid by the Celsius fraud. Unfortunately for Sarson, in June 2022 Celsius Network froze withdrawals. Based on bankruptcy filings, Stablecoin Index LP has over $420,000 worth of stablecoins and other assets stuck in Celsius Network:

After Celsius collapsed, their strategy changed. According to the most recent proposal on their website (dated 11/1/22), the Stablecoin fund was:

…tactically deployed to various on-chain income-generating opportunities or deposited with the Gemini Earn program based on prevailing market conditions.

Unfortunately, in November the Gemini Earn program met an ignominious end. Gemini was acting as a feeder fund for Genesis Lending, a subsidiary of the Digital Currency Group. Genesis froze withdrawals in November 2022 after losing a substantial sum in FTX. Prior to that, Genesis had been teetering on the edge of insolvency due to massive losses on loans to the failed crypto hedge fund Three Arrows Capital. Consequently, all of the Gemini Earn capital was frozen upon the collapse of Genesis. It is unclear whether Sarson was able to exit Gemini Earn prior to this disaster, or if the fund has investor capital trapped in this failed enterprise as well. It is also unclear how Sarson is accounting for the exposure to these failed firms.

The ill-fated Stablecoin Index is only one of several opportunities offered by Sarson Funds. Other options include their “Cryptocurrency ESG Strategy,” “Large Coin Fund,” “Small Coin Fund,” and their “Crypto and Income Strategy.” These funds have understandably benefitted from being early to the pyramid game, with some showing massive gains of 200-300%. Of course, these figures are all before fees: Sarson charges their clients a classic hedge fund fee set of 2% of the principal and 20% of the generated income.

Despite high returns, Sarson’s strategies have often underperformed the markets. For example, the Blockchain Momentum LP “Large Coin Strategy” massively underperformed the returns of a passive Bitcoin index even before fees are deducted:

In addition to offering these “investment strategies,” Sarson also provides educational materials for learning about the crypto-conomy. These materials demonstrate the general lack of insight and common sense displayed by the firm. For example, Sarson posted an article from April of 2022 touting the Terra/Luna Ponzi scam as “Revolutionizing Digital Payments:”

Terra’s explosive growth over 2021 and 2022 has positioned the network to lead the future of blockchain innovation and adoption….Terra has established itself as the cutting edge of digital payments, especially in the Asian e-commerce market. 

A month later, the Terra system collapsed. Sarson Funds then posted a new article entitled “UST and Luna: What Went Wrong?” Other articles tout other frauds like the Helium network, which Sarson Funds has also invested in.

Like Sarson’s investment “opportunities” and educational offerings, the firm’s consulting gigs have also been duds. The firm’s website lists multiple projects that Sarson has advised. These include a cryptocurrency project called “Crown Sterling” which purports to offer “quantum-resistant” identity protection services. Of course, since quantum computers remain a far-off aspiration, their claims seem somewhat… questionable. The project’s token has performed about as well as one might expect, down over 90% from its opening price:

Sarson also advised a DeFi project called “Popcorn Network,” which describes itself as:

Popcorn is a regenerative yield optimizing protocol with soul.

It's easy to deposit crypto, optimize yield, and create positive global impact at the same time.

Sounds legit, right? Again, their token has performed about as well as one would expect, down about 80% from its opening price:

It’s interesting to note that Sarson’s “Cryptocurrency ESG Fund” held 4.7% of its assets in the Popcorn Network “POP” token. This might seem like a conflict of interest given Sarson acted as an advisor to the project, then put his investors’ funds into that same project:

Feeding the crypto-conomy is hard and thankless work…

Unfortunately, Sarson Funds only one small example of a myriad of similar crypto feeder funds operating throughout the world. Impressively, despite Sarson Fund’s micro size, it managed to gain exposure to almost every major crypto fraud in the last year. And note that we didn’t even touch on the many smaller frauds that Sarson Funds has exposed their investors to.

Sarson’s careless approach to deploying investors funds is a microcosm of the wider scam-ception that occurred in the crypto-conomy: Too busy to do the work themselves, firm after firm outsourced the hard work of generating returns to downstream entities, performing minimal due diligence in the process. In several instances, investors’ funds were dumped directly into obvious Ponzi scams. Consequently, when one of the firms failed, the resulting contagion brought down the entire edifice.

It remains to be seen whether Sarson Funds, and others of their ilk, survive the continuing crypto winter.

Here’s a business proposition for you: There are lots of individuals and companies out there who have a hard time accessing banking, for a variety of reasons. So why not offer the following service to the unbanked: They can give their dollars to you to store. You invest the money in bonds and generate interest, which you get to keep. In return, your customers receive shares worth $1 of the underlying asset pool. These shares are bearer assets, so your customers can use the notes like currency without any oversight on your part.

Congratulations: You’ve just built an unregistered money market fund enabling near-anonymous transfers of dollar equivalents! What could go wrong?

Crypto stablecoin issuers have built their industry around a similar model. Stablecoins act like casino chips within the crypto-conomy. To obtain tokens, you can give dollars to the issuer who then “mints” an equivalent number of stablecoin tokens on the blockchain. Those tokens can then be used to make purchases or transfer funds to others. When you want to take dollars out of the system, you can send the stablecoins back to the issuer. You get a bank transfer and the tokens are “burned” and disappear from the blockchain.

A similar model was tried before: From 2006 to 2013, a Costa Rican company called Liberty Reserve issued “digital dollars” that could be freely transferred between customers, with Liberty Reserve holding the real dollars in the interim. Liberty Reserve’s minimal KYC/AML practices landed them in hot water, and the firm was shut down by U.S. authorities. The founder, Arthur Budovsky, was sentenced to 20 years in prison.

One major difference between the current iteration of stablecoins and Mr. Budovsky’s service is that, instead of hosting all transactions internally, stablecoins are issued on public and decentralized blockchain platforms. While the stablecoin issuer initially does KYC/AML procedures when minting or burning the tokens, once the tokens are issued they have limited insight into who holds the tokens or what the tokens are being used for.

This brings us to a recent statement by the Federal Reserve board on the issuance of stablecoins on public blockchains (emphasis added):

The Board generally believes that issuing tokens on open, public, and/or decentralized networks, or similar systems is highly likely to be inconsistent with safe and sound banking practices. The Board believes such tokens raise concerns related to operational, cybersecurity, and run risks, and may also present significant illicit finance risks, because—depending on their design—such tokens could circulate continuously, quickly, pseudonymously, and indefinitely among parties unknown to the issuing bank. Importantly, the Board believes such risks are pronounced where the issuing bank does not have the capability to obtain and verify the identity of all transacting parties, including for those using unhosted wallets.

This statement was issued as part of the Fed’s new crypto rules for state banks. While these regulations will not directly apply to current stablecoin issuers, we believe that the Fed governors’ concerns about stablecoins are shared by other regulators. This statement precisely captures the risks of stablecoins as currently implemented.

Let’s take a look at one of the biggest stablecoins in crypto, the USDC token. Using a few specific examples, we will show: (1) stablecoins are regularly used by dubious actors to move massive sums of money internationally with minimal oversight, (2) stablecoins are regularly used in fraudulent transactions, and (3) stablecoin issuers provide shadow banking services for other crypto entities that are unable to access traditional banking services.

USDC is used by questionable characters to move billions of dollars internationally

Circle operates the USDC stablecoin, the second-largest stablecoin by market cap (Today $41.3 billion). USDC is widely regarded as the “stablest” stablecoin; the reserves backing the token are relatively transparent and the issuer has a strong reputation. For some reason, though, this has not translated to popularity in trading; USDC consistently lags the #1 and #3 largest stablecoins in terms of daily volume:

Circle enables some interesting characters to do some interesting things. One example is the infamous Justin Sun, who has a decidedly poor reputation even by crypto community standards. His Excellency (yes, he is also a Grenadian Ambassador) has moved over $1 billion through Circle system over the past 2 years, usually in 8- or 9-figure transactions.

Here’s one example from a couple months ago:

Justin Sun had $100 million worth of the Tether stablecoin (USDT) issued on the Tron blockchain (1). He subsequently transfers the USDT from the Tron blockchain to the Ethereum blockchain using Binance to “hop” chains (2). Next, he uses a decentralized exchange (DEX), which requires no KYC/AML to use, to swap the USDT stablecoins for an equivalent number of USDC stablecoins (3). He then sends the USDC to Circle, burning the blockchain tokens to claim real dollars (4).

In other words: Sun takes $100 million in tokens issued by an offshore and unregulated entity and converts it to real dollars in an onshore U.S. bank. It would be impossible for Circle to determine where these funds originated. Sun could have obtained the original USDT by giving Tether dollars overseas, or by using crypto as collateral to borrow the USDT. In either instance, Circle would not have any visibility into the source of the funds.

In the traditional banking world, it would likely be difficult to accomplish a $100 million transfer like this without significant oversight and monitoring. With the magic of the blockchain, it can happen in a few hours. Billions of dollars can flow without touching the traditional financial infrastructure with its pesky rules and regulations. Like the Fed pointed out:

….such tokens could circulate continuously, quickly, pseudonymously, and indefinitely among parties unknown to the issuing bank….

USDC and other stablecoins have facilitated fraud

Back in August 2022, we stumbled onto a network of fake cryptocurrency exchanges tied to a common registered agent in Colorado. We discovered that this network had pulled in tens of millions of dollars in stablecoins from victims. Briefly, the scam worked by tricking people into believing they had made large profits then hitting the marks up for “taxes” and other fees. When the victims would go to withdraw, they’d discover that the funds were missing.

Dirty Bubble Media

The BitDogEx Swindle

“Sam” was in a dilemma. Starting with only a few thousand dollars, he had recently made over $1 million by partnering with a mysterious cryptocurrency trader he had met on Discord. Now the exchange he and the trader were using, Bitdogex, was sending threatening emails stating that Sam owed thousands of dollars in “taxes” that had to be pa…

Read more

4 years ago · 11 likes · 2 comments · Dirty Bubble Media

When we followed the money from a victim who alerted us to the fraud:

We discovered a network of wallets. The first layer of deposit addresses accepted transfers from a large number of individual wallets and exchanges. The deposit wallets then sent their funds forward, eventually all collecting to a core wallet. Since this wallet was created in November 2021, it has received over $60 million in USDT ($48 mil), USDC ($12 mil) and Ether ($400,000).

We made another interesting discovery when we followed where the proceeds of the fraud. All $12 million in USDC traveled to the relatively small “MEXC Global” crypto exchange. It turned out that MEXC’s U.S. operation was incorporated by the same registered agent that was involved with the fake crypto exchanges. What a strange coincidence…

All this to say: This is just one example, among many, of stablecoins like USDC being used to facilitate fraud. Due to the current design of USDC, Circle only performs KYC/AML procedures when someone directly mints or burns USDC. As a result, it is nearly impossible for Circle to proactively prevent these kinds of fraudulent activities. Again, to return to the Fed statement:

…the Board believes such risks are pronounced where the issuing bank does not have the capability to obtain and verify the identity of all transacting parties…

Circle is acting as a shadow bank for other crypto firms

Crypto exchanges have faced increasing difficulties finding banks and payment processors willing to do business with them. The list grows smaller each day as regulatory pressure increases. One example is Crypto.com, which has struggled recently to find partners willing to help it access financial markets. Their primary European payment processor, Transactive Systems, was recently shut down for flagrant money laundering violations by Lithuanian authorities.

It appears that Crypto.com found at least one work-around for this problem: According to customers, when they go to send real dollars to these exchanges the beneficiary is listed as Circle:

Based on this information, it appears that the dollars end up stashed with Circle, and the customer ends up with USDC held by Crypto.com instead. This seems reasonable based on blockchain transfers: Wallets tagged to Crypto.com have received at least $1 billion in USDC from Circle over the last year.

This means that Circle is entrusting its partners, like Crypto.com, to appropriately perform KYC/AML procedures. It also means that Circle is acting like a bank for Crypto.com and other exchange partners. Since these firms can’t access banking easily on their own, Circle warehouses their cash and issues them fungible deposit tokens in return.

Stamping out stablecoins?

While many uses for stablecoins are legitimate, in their current form these financial instruments facilitate questionable and outright illegal activities. Fraud can certainly happen on other payment services; for example, there was rampant fraud in the early days of Paypal. However, the problem with stablecoins is that their design makes appropriate oversight by the issuer nearly impossible. Once the token is transferred to an unknown third party, it can go anywhere and be used for anything.

As we were completing this article, another major stablecoin, Binance USD (BUSD), ended up in the headlines. Issued by the New York-based Paxos Trust, BUSD is the primary mechanism Binance uses to move dollars. As we have documented before, Binance has often struggled to maintain its access to banking. Binance holds billions of BUSD on its books, leaving the problem of holding real dollars to Paxos.

It turned out that the relationship between Paxos and Binance drew regulatory attention, and it was announced that the New York Department of Financial Services was investigating. Shortly thereafter, news broke that Paxos received a Wells notice from the SEC asserting BUSD is a security. And on Monday, Paxos announced that they will no longer be issuing new BUSD:

We have to wonder how long it will be before regulators take a crack at the remaining major stablecoin issuers…

One of the greatest appeals of cryptocurrency, at least to crypto touts, is the potential to replace state-issued currency with decentralized and autonomous alternatives. The theory goes that this replacement will lead to greater transparency, freedom, and equality by separating the power of the state from money.

Despite this lofty goal, to date the crypto-conomy remains dependent on “fiat” currency to do business. It turns out that it is still pretty difficult to pay bills using blockchain tokens. This means that cryptocurrency traders like having the ability to convert crypto into dollars, euros, and other state-backed money. At the same time, crypto businesses need continued inflows of real money to keep their operations running.

Unfortunately for the crypto exchanges, the collapse of the FTX fraud has forced regulators to start taking a much closer look at how these entities do business. Due to their penchant for convoluted offshore structures, questionable ownership, and propensity to get involved in dirty business, there is increasing pressure on traditional banks to stop doing business with crypto businesses. Recent news demonstrates that the pressure is increasing, with the consequence that the crypto-conomy is being isolated from the real world of finance.

Let’s take a look.

Binance cut off from US banking

On January 21st, Binance customers received an email stating that starting February 1st, the exchange would no longer be able to process dollar transfers over SWIFT of less than $100,000. According to this notice:

The banking partner that services your account has advised they are no longer able to process SWIFT fiat (USD) transactions for individuals of less than 100,000 USD as of February 1st, 2023. This is the case for all of their crypto exchange clients. Please be advised that until we are able to find an alternative solution, you may not be able to use your bank account to buy or sell crypto with USD… Our team is actively seeking a new SWIFT (USD) partner to avoid any interruption of service.

As we had previously reported, Binance was using Signature Bank of New York to process dollar transfers via a Seychelles shell corporation, Key Vision Development LTD. A few hours after Binance’s new USD limits became public, Bloomberg confirmed that Signature Bank was Binance’s banking partner and had placed these new limits on their activity.

We find it interesting that Signature chose to place these onerous limits on Binance just days after we and others publicized their questionable relationship!

Dirty Bubble Media

Signs of Trouble at Signature Bank

Note: For the first time in our brief journalistic career, we are short the subject of the following article.* What follows is not investment advice and for informational purposes only. The crypto-friendly Silvergate Bank (SI) has had a rough couple of months. Ever since it was revealed that Silvergate was doing a lot of business with the now-disgraced c…

Read more

3 years ago · 49 likes · 3 comments · Dirty Bubble Media

Things just got worse from here: Yesterday, Binance notified its customers that ALL dollar transfers would be suspended in just two days:

This means that, effectively, Binance customers are unable to directly transfer US dollars into, or out of, the exchange. Binance customers are now being directed to use their “peer to peer” service, where individuals sell crypto for dollars directly in a marketplace faciliated by Binance. This seems like a good alternative to a normal bank transfer, except for the part where your “peer” steals your money:

Of course, this is just a “temporary” issue because Binance won’t have any problems finding a new U.S. bank to do business with.

Right?

Crypto.com’s payment processor shut down by Lithuanian authorities as part of massive fraud crackdown

Crypto.com, of Matt Damon and Staples Center fame, had been processing Euro transfers through a company called Transactive Systems. Transactive is a Lithuanian payment processor owned by a British corporation called Transactive Systems Ltd. Transactive’s CEO and director was previously the “country director” for a major payments firm called Payoneer. Notably, Payoneer had its own issues with providing services to fraudulent entities.

On January 22, Crypto.com users began reporting that they were unable to make or receive Euro transfers. Shortly thereafter, Crypto.com announced that they were “migrating” to a new payment processor:

Tracking down the reasons for this switch, a sharp-eyed crypto researcher discovered that Transactive’s website had an interesting new notice:

It turned out that Lithuanian authorities had essentially shut Transactive down for flagrant violations of money laundering and international sanctions. Notably, another crypto client of Transactive was Nexo, which was recently raided as part of an international investigation into fraud and possible sanctions violations…

Bloomberg subsequently published a detailed report about Transactive, including more interesting history about some of its employees:

Multiple high-level employees who helped set up and run Transactive came from PacNet Services Ltd., a company that had to close down after being sanctioned by the United States for being the “payment processor of choice” for scam artists. Several are being targeted by authorities, including one facing federal fraud charges who remained a senior Transactive employee until just weeks ago. In June, a founding investor was sentenced to two years in jail for his part in an unrelated $1 billion healthcare fraud.

According to Bloomberg, Transactive was moving tens of billions of euros annually before the crackdown and was the second-largest electronic money processor in Lithuania.

Crypto.com eventually resumed transfers, now using a Malta-based payments processor called OpenPayd. OpenPayd also acts as payment processor for the infamous Bitfinex exchange, demonstrating this firm’s willingness to do business with literally anyone….

What’s coming next?

Regulators and enforcement agents are now circling the crypto industry. In the wake of the collapses of FTX and Genesis, the pressure on anyone doing business with crypto entities will continue to grow. With key crypto servicing banks like Signature and Silvergate deserting the industry, these firms and their customers will face increasing challenges getting their hands on “fiat” currency.

We will continue to focus on the methods being used to move real money into the crypto-conomy in the coming days. These investigations might lead to some interesting places. Stay tuned.

Crypto Capital Corp occupies an infamous place in crypto history. A Panamanian payment processing firm founded in 2013, Crypto Capital was led by a former co-owner of the Minnesota Vikings named Reggie Fowler. In the background were two Israeli-Panamanian siblings, Oz and Ravid Yosef, who provided expertise in setting up shell companies in offshore jurisdictions. By 2017, Crypto Capital had established a dominant role servicing the crypto industry. Bitfinex, Kraken, BitMex, and the infamous QuadrigaCX were all clients who used Crypto Capital to handle customer transfers of real currency. The exchanges often maintained large deposits with their shadow bank as they didn’t have legitimate banks to house the funds.

Unfortunately, in late 2018, these exchanges began experiencing significant difficulties in accessing money held with Crypto Capital. In mid-2019, it became clear why: U.S. authorities had seized some $850 million held by Crypto Capital as part of an investigation into money laundering. Subsequently, Mr. Fowler (a former co-owner of the Minnesota Vikings) was arrested and later convicted on charges of fraud. The Yosef siblings were indicted but apparently remain at large.

One might wonder: With the collapse of Crypto Capital, how did cryptocurrency exchanges continue to access the real world of finance? The problems faced by these companies were partially solved as crypto found more mainstream acceptance, with major banks in regulated jurisdictions taking on these firms as clients.

However, crypto firms often prove to be too hot to handle for traditional banks. For example, just a few days after we proved Signature Bank was providing services to Binance through a shell corporation, Signature limited Binance’s transfers to >$100,000, essentially cutting the exchange off of dollars from retail customers.

Due to these challenges, many crypto exchanges have continued to partner with questionable offshore payment processing entities to do business. We believe we have discovered one of the major firms providing these services today: Advanced Cash Limited (Advcash).

Advcash’s clients include the crypto exchanges Binance, Huobi, OKCoin, and the Nexo crypto lending firm. It turns out this company, while legally domiciled in Belize, actually appears to be operated out of Eastern Europe and Russia. Its founder and CEO is tied to at least one failed cryptocurrency scheme. And it turns out that another major crypto payments firm shares links to both Advcash and to the same crypto scam…

Advanced Cash

While investigating Binance’s links to the real economy, we discovered Advcash was one of the primary means listed by the exchange for transferring both USD and other currencies onto the exchange:

AdvCash was recently in the news due to its relationship with Binance. In April 2022, Reuters reported that Binance had a close relationship with a Russian intelligence-linked agency. AdvCash was identified as a payments processor facilitating ruble transfers to Binance:

Binance targeted Russia for expansion, noting in a 2018 blog post the country's "hyperactive" crypto community. The exchange partnered with Belize-based payment company Advcash to enable users to deposit and withdraw roubles using bank cards. Advcash said the partnership is still active.

AdvCash’s user agreement states it is based at “35 Barrack Road, Third Floor, Belize City, Belize.” Coincidentally, this address appears in the Panama Papers. It appears there are a number of entities listing this as their corporate address.

When examining Advcash’s website, they notably provide a couple different customer service numbers for questions. These numbers are for call centers located in Kazakhstan and Russia:

Of the 28 Advcash employees listed on LinkedIn, eight are based in Russia, seven in Ukraine, and three in Estonia. Advcash’s site states that some 30% of their customers are from Russia and other CIS countries.

Advcash lists partnerships with multiple major cryptocurrency exchanges, including Binance, Kraken, Huobi, and OKCoin. By reviewing these firms’ websites, we were able to independently confirm that all of these companies do business with Advcash with the exception of Kraken.

Advcash touts a special partnership with Binance on its site, stating that Advcash customers can link their Binance accounts directly and take advantage of fee-free transfers to the exchange. Binance, in return, has an entire page on their website dedicated to instructions on how to use Advcash to send and receive fiat currency from the exchange

Advcash also offers its own crypto wallet service with a linked interest-earning option. That option is offered via a partnership with Nexo, the questionable crypto lending business we have talked about before. It’s worth noting that Nexo’s offices in Bulgaria were raided only a few days ago as part of an international investigation into money laundering and sanctions evasion by Russian parties.

Advcash touts other interesting services on its site. For example, they offer a service to provide customers with International Banking Account Numbers (IBAN) to ensure that there are “no more SEPA payments to/from exchanges that your bank doesn’t like.” In other words, ADVcash is offering to assist its customers in hiding financial activity from their banks. Seems… questionable.

Advcash also offers multiple prepaid debit card options, advertising these as “a new ‘anonymous’ bitcoin debit card.” In Advcash posts to a Bitcoin forum, they discuss offering a prepaid card that can be “funded with cryptocurrency” including stablecoins:

Advcash’s CEO was an advisor to a Russian-led 2018 scam Initial Coin Offering

Advcash’s CEO is Miami-based Yaacov Bitton. His LinkedIn lists jobs at payday lending and check cashing businesses prior to starting Advanced Cash in 2011. Bitton’s LinkedIn also includes a few posts, one of which caught our eye:

Mr. Bitton was an advisor to the Native Video Box initial coin offering (ICO) in 2018. Initial coin offerings, a play on legitimate “initial public offerings” of stock, sold investors cryptocurrency tokens ostensibly linked to a new company. Native Video Box purported to be “a next-generation decentralised video distribution platform, based on cutting-edge technologies of multi-tier blockchain and deep machine learning.”

This project managed to raise over $6 million from investors. However, after successfully pulling in money the founders quickly vanished and never delivered on their promises. Investors were left holding worthless tokens, a familiar theme to anyone involved in the crypto-conomy.

The leaders of another major crypto payments service, Mercuryo, are alumni of the Native Video Box scam

While learning about Advcash, we discovered another Russian crypto payments service tied to Advcash called Mercuryo. Mercuryo boasts partnerships with many of the same cryptocurrency companies as Advcash:

Mercuryo purports to offer a full-service payments operation, taking care of everything from “liquidity” to KYC:

Advcash and Mercuryo recently announced a partnership:

Advcash, a digital currency and payments platform, has partnered with Mercuryo, a global payments infrastructure provider, to provide its users with banking-as-a-service. With Mercuryo's platform, any business can open a bank account as well as interact with and convert crypto to fiat currency, according to a press release.

It turns out that this is not the first time Mr. Bitton and the leaders of Mercuryo have teamed up, as both founders of Mercuryo were executives for the Native Video Box scam:

Some strange coincidences…

Two payments services, both closely linked to Russian parties and to cryptocurrency fraud, are providing substantial financial services to many of the biggest crypto exchanges in the world. Advcash also offers a service to obfuscate customers’ activites from their own banks.

Several of these exchanges simultaneously do business through well-recognized and regulated banks like Silvergate and Signature.

At this time, we have no evidence to suggest that Advcash or Mercuryo are engaging in illegal activities or sanctions violations. However, given their close ties to one another, to at least one previous fraud, and their critical role within the wider crypto-conomy, we think that regulators and investigators might want to take a closer look at both firms…

Note: We remain short Signature Bank. What follows is not investment advice and for informational purposes only.

We recently published an article discussing potential regulatory issues faced by Signature Bank (SBNY), a New York-based commercial bank with close ties to the cryptocurrency industry. In this piece, we discussed how Signature offers a private blockchain solution called “Signet,” which allows the bank’s customers to make intrabank transfers to other Signet clients instantaneously, for any amount, at any time. With hundreds of billions of dollars worth of transfers over its history, Signet has become one of the most attractive offerings for Signature’s crypto clients.

To protect Signet from being used by bad actors, Signature implemented what their chairman Mr. Shay called a “walled garden" approach:

SHAY: We built what I like to call a “walled garden.” If you pass through this walled garden and you’re a miner, you’re an exchange, you’re a custodian… if you get through our vetting process— we have a strenuous KYC/AML process because we are an American onshore bank— then you’re going to get into this walled, gated community and you’re going to get access to Signet. And Signet is a blockchain-enabled tool that you can use with other people who are part of this community so you know they have been vetted…

We suggested that this might be a problem if Signature’s procedures failed to identify bad actors and pointed to some public evidence that suggested Signature had allowed bad actors to use their platform. Chief among them was FTX, which had several accounts at Signature Bank. However, we did not have a list of Signet clients to determine how bad things might actually be.

Recently, we obtained an official list of some of Signet’s clients from November 2021. This list was distributed as a marketing effort and includes an email at the bottom for interested parties to contact. In the interest of advancing public awareness, we are publishing the entire document (with email redacted). We have included red boxes around certain entities that we think might merit further attention:

We note that there are several problematic entities among this list. In addition to FTX, here are just a few to mull over.

Binance

Signature lists the Binance exchange as one of their Signet clients. This is concerning as Binance has a long history of difficulties with obtaining banking relationships in the United States. In fact, even Silvergate Bank ended up dropping Binance as a client in 2021. We have recently covered some of the problems with Binance in detail:

Dirty Bubble Media

Is Binance.US a Fake Exchange?

In the final days of the FTX collapse, onlookers wondered about the solvency of FTX’s U.S.-based exchange, FTX.US. FTX.US was ostensibly held at arms length from the parent exchange. FTX leadership insisted that customers of the FTX.US division would be safe even if the parent company went under. However, when the end came for FTX, FTX.US met the same f…

Read more

3 years ago · 123 likes · 27 comments · Dirty Bubble Media

We were able to independently confirm that Binance, as of 1/16/23, was still listing Signet as an option for transferring funds to their exchange:

We were separately able to confirm that, as of 1/16/23, Signature Bank is still enabling individuals to transfer US dollars to Binance via Key Vision Development Limited, a Seychelles shell corporation:

Genesis Block OTC

Genesis Block OTC was an over-the-counter crypto exchange operating in Hong Kong. As we previously discussed, Genesis Block was well-known to exchange cash for crypto. According to a bombshell report by the Financial Times:

At the time, Genesis Block was drawing a crowd with its unusual business model: in a world dominated by the web, it was exchanging crypto for physical cash. “People were literally lining up around the corner with bags of cash at Genesis Block,” a former employee said. “Sometimes they shut the door saying they were out of bitcoin.”

We were able to show using blockchain analysis that Genesis Block was little more than a front company for Alameda Research, as crypto transfers to Genesis Block ended up going immediately to Alameda’s wallets:

Dirty Bubble Media

Blockchain evidence suggests Genesis Block was a front for Alameda Research

Every day there are new revelations about Sam Bankman-Fried’s FTX/ Alameda Research crypto conglomerate. As a refresher, Sam first founded Alameda Research in 2017 as a “crypto hedge fund.” The FTX exchange was subsequently started in 2019. Both firms were based in Hong Kong until 2021, when SBF abruptly moved most of his operations to the Bahamas. Howe…

Read more

3 years ago · 49 likes · 6 comments · Dirty Bubble Media

Genesis Block shut its doors shortly after the collapse of FTX. And guess what? They were banking at Signature Bank too. We wonder if some of those bags of cash made it onto the Signet blockchain…

Nexo Services OU

Another one of the usual suspects at Dirty Bubble Media, Nexo is a crypto lending company that recently exited the United States market due to regulatory concerns. Their offices were raided a few days ago as part of an international investigation into money laudering and sanctions violations. Signature lists “Nexo Services OU” as a Signet client. We can confirm this is a Nexo-affiliated corporation as it was named as part of a recent civil suit against the company.

Dirty Bubble Media

Nexo is Rekto

About eighteen months ago, we launched Dirty Bubble Media to investigate fraud and malfeasance. We spent a lot of our time focused on centralized cryptocurrency lending platforms (“CeFi”). We did so because it was easy to recognize the many warning signs: Unregistered offerings, questionable founders, absurdly high interest ra…

Read more

3 years ago · 44 likes · 10 comments · Dirty Bubble Media

Huobi

Huobi is an international cryptocurrency exchange. It is known to be controlled by a group of investors led by Justin Sun, a notorious figure in the cryptocurrency world. We have not bothered to write about Mr. Sun, because Christopher Harland-Dunaway did the job last year with a detailed profile in The Verge. In this piece, Mr. Sun is noted to collect bank accounts like baseball cards, to regularly make sudden exits from various countries when under legal pressure, and to have an, um, dismissive attitude towards basic compliance practices:

Everywhere else at Poloniex, token listing requirement approvals slackened — a return to “YOLO Polo,” as one employee described it. Sun also began impatiently bulldozing Poloniex’s KYC rules, which were slowing Poloniex’s user adoption in China to a crawl. A former employee said the logjam enraged Sun. “Fake the KYC!” he screamed at one meeting. “Fake it!” 

Huobi is listed as having multiple accounts with the Signet platform.

Genesis Trading 3AC, and FTX

Genesis Trading and its parent company DCG have recently been in the news due to financial problems. These problems appear to stem back to a disastrous relationship with the crypto hedge fund Three Arrows Capital (3AC), which collapsed in June after a number of bad bets on crypto markets. According to analysis by the excellent DataFinnovation, it appeared that Genesis lent 3AC Bitcoin to deposit into DCG’s other crypto product, the Grayscale Bitcoin Trust:

It looks like DCG and 3AC were engaged in some kind of scheme to extract value from the GBTC premium. This provided massive leverage for 3AC which they encashed and used to fund a wide range of things. It also generated a lot of short-term profits for DCG via fees. But 3AC was wildly leveraged and they appear to have gone insolvent over the Terra-Luna weekend. The epic losses from this blowup are only starting to be felt. And GBTC may be the center of bigger trouble.

This was confirmed publicly by one of the founders of 3AC, Zhu Su:

Su has also alleged that Genesis and FTX colluded to manipulate crypto markets for mutual gain:

Genesis, 3AC, FTX, and Alameda are all listed as Signet customers. This means any dollar transfers between these entities are captured on the Signet blockchain in perpetuity. Hint hint.

If we could issue subpoenas…

… the first place we would be looking would be the Signet and SEN blockchains. These two platforms have handled over $1 trillion of transactions between many of the biggest, and most questionable, entities in the cryptocurrency industry. The answers are there, for anyone who can go looking.

Alas, we must be satisfied with the bits and pieces we can see… and wait.

About eighteen months ago, we launched Dirty Bubble Media to investigate fraud and malfeasance. We spent a lot of our time focused on centralized cryptocurrency lending platforms (“CeFi”). We did so because it was easy to recognize the many warning signs: Unregistered offerings, questionable founders, absurdly high interest rates, and no clear mechanism for generating those rates.

We spent a good portion of time on the Celsius Network, a crypto lending firm that collapsed in June due to mismanagement and possible fraud. Their founder and CEO, Alex Mashinsky, was recently sued by the New York Attorney General for fraud. Another large crypto lending company, Blockfi, met a slower demise after it was temporarily “bailed out” by the FTX exchange. Of course, once FTX collapsed Blockfi followed shortly thereafter.

The last man standing of the cryptocurrency lending industry was Nexo, a Bulgarian firm operating in multiple countries. In September, we warned that Nexo was likely insolvent:

Dirty Bubble Media

Is Nexo Nexto?

On September 26, 2022, eight states filed emergency cease and desist orders against the crypto lending firm Nexo. The regulators assert that Nexo has been offering various products illegally to state residents and that the company has misrepresented the risk associated with those products. The regulators also make a shocking clai…

Read more

4 years ago · 20 likes · 7 comments · Dirty Bubble Media

That month, multiple state securities regulators had filed cease and desist orders against Nexo. One of these orders from the state of Kentucky asserted that Nexo was actually insolvent without marking their holdings of their proprietary NEXO token to market. We demonstrated that this token was, like CEL and FTT, effectively worthless:

Per the Kentucky filing, Nexo sold 525 million tokens during the ICO, retaining the remaining 475 million $NEXO on its own balance sheet. Nexo could then mark-to-market their $NEXO holdings and show good financial health.

According to regulators, Nexo now holds ~95% of the total NEXO tokens in existence on its balance sheet. A quick glance at the token distribution on Etherscan bears this claim out, as the major addresses holding $NEXO are directly linked back to the company.

We showed that NEXO token was thinly traded on very questionable exchanges and that the volumes reported in the biggest market, MEXC Global, appeared entirely fake:

Oddly enough, when we looked at MEXC Global’s official Ethereum wallet, we discovered that it only holds 95,716 $NEXO tokens, despite hosting several millions of dollars worth of daily NEXO trades. In other words, MEXC Global’s daily NEXO trading volumes are roughly 40x higher than the total number of NEXO tokens they hold in their main wallet:

One of Nexo’s major appeals to transparency was their “real time audit” from the accounting firm Armanino. We talked about the problems with this supposed “audit” in December of last year:

Dirty Bubble Media

Arthur Armanino

In 2001, after the collapse of the energy trading firm Enron, it was discovered that their auditing firm Arthur Andersen had failed to detect blatant fraud and malfeasance on the part of their client. Arthur Andersen subsequently folded after it was charged with complicity in one of the largest corporate frauds …

Read more

3 years ago · 49 likes · 11 comments · Dirty Bubble Media

Nexo initially fought back against our reporting, claiming that Nexo tokens were “less than 10% of total assets.” However, they never provided a claim regarding their NET assets. In December, Nexo abruptly announced that they would be leaving the United States due to “regulatory concerns.”

Today, it was announced that Nexo’s offices in Sofia, Bulgaria were raided as part of a multinational investigation into their firm. Allegedly, Nexo was helping Russian entities and individuals evade E.U. and U.S. sanctions:

An international operation against a large-scale scheme for financial crimes, money laundering and violations of international sanctions against Russia is taking place in Sofia at the moment. According to BNT, it is the company NEXO.

The investigation...began a few months ago, after foreign services detected suspicious transactions, which were reported to be aimed at circumventing the sanctions imposed by the European Union, Great Britain and the United States against Russian banks as well as companies and citizens of the Russian Federation.

.… In recent months, the FBI has been investigating the activities of the Bulgarian crypto platform due to data on a hidden hole in the amount of over 4 billion dollars from investors...."

This is an evolving story, and we look forward to learning more in the coming days.

Two parting notes: We observe that Armanino’s Real-Time Attest site still lists Nexo as “fully backed” as of this morning:

And that Silvergate Bank, under significant regulatory and legal scrutiny for banking the FTX fraud, was also providing banking services to Nexo:

Birds of a feather…

Note: For the first time in our brief journalistic career, we are short the subject of the following article.* What follows is not investment advice and for informational purposes only.

The crypto-friendly Silvergate Bank (SI) has had a rough couple of months. Ever since it was revealed that Silvergate was doing a lot of business with the now-disgraced crypto mogul Sam Bankman-Fried, investors and customers have grown wary of certain heretofore unappreciated risks of working with cryptocurrency businesses. Silvergate shed 68% of their total deposits, some $8.1 billion, in this quarter according to preliminary reports. Their need for cash forced them to sell debt instruments early, reportedly leading to a loss of some $718 million.

Silvergate’s financial woes are matched by its legal concerns. It was discovered that Silvergate was allowing Alameda Research to receive customer deposits that were supposed to be going to the FTX exchange. In addition to new attention from regulators, Silvergate faces a class action lawsuit from FTX victims alleging that the bank was complicit in the FTX fraud.

While Silvergate has received most of the public wrath for its role in this fraud, another crypto-friendly bank has avoided much attention from the media: Signature Bank of New York (SBNY). Silvergate and Signature have unique relationships with the cryptocurrency industry. Both companies created their own private blockchains, the Silvergate Exchange Network (SEN) vs. SBNY’s Signet, to service their crypto clients by providing 24/7/365 dollar transfer services. These services have been wildly popular, with each firm performing hundreds of billions of dollars in transaction volume each quarter:

Both banks provide depository services for crypto exchanges, funds, and stablecoins. Signature is one of the major holders for the deposits backing the major stablecoin USDC as well as banking dozens of other major crypto firms.

Signature has downplayed its exposure to the collapse of FTX by specifying that they never made loans to the defunct exchange, only that they had a “deposit relationship.” They have also announced they are going to try and sell off up to $10 billion of their crypto related deposits. This announcement seems to have anticipated a joint warning from the FIDC, OCC, and Federal Reserve about banking for crypto companies.

The lack of attention on Signature may be about to change. Signature faces significant and obvious risks from holding large deposits for crypto entities at risk of sudden and massive withdrawal pressures. As seen with SI’s preliminary Q4 results, these withdrawal pressures can be severe and lead to massive losses for the bank when it needs to come up with the money. However, crypto bank runs are not the only risk Signature faces in the coming months. According to recent revelations, Signature may face significant legal and regulatory consequences from doing business in the fast and loose world of cryptocurrency.

Signature’s Signet blockchain: A “walled garden” full of snakes…

Signet is Signature’s own private blockchain. “Signets” on this blockchain are tokens representing dollars, very similar to stablecoins on public blockchains like Ethereum. Signture’s approved Signet customers can use this blockchain to make instant dollar transfers to other Signet clients 24 hours a day, 7 days a week. Signet has become a very popular alternative to Silvergate’s SEN system.

In 2021, the chairman and co-founder of Signature Bank sat down with “The Asian Banker” for an extended interview about Signature’s crypto adventures. This interview is fascinating and worth watching in its entirety. Mr. Shay states he was interested in cryptocurrency relatively early and was seeking to find ways to bank with crypto firms for years before they developed Signet. In this interview, Mr. Shay refers to SIGNET as a “walled garden:”

SHAY: We built what I like to call a “walled garden.” If you pass through this walled garden and you’re a miner, you’re an exchange, you’re a custodian… if you get through our vetting process— we have a strenuous KYC/AML process because we are an American onshore bank— then you’re going to get into this walled gated community and you’re going to get access to Signet. And Signet is a blockchain-enabled tool that you can use with other people who are part of this community so you know they have been vetted…

Shay places a lot of faith in this vetting process. There’s an interesting point where the interviewer asks a prescient question:

INTERVIEWER: Do you ever lose sleep that there might be a Mt. Gox there somewhere in that pool of clients… the regulators will come after you…?

SHAY: Here’s the thing. We’re not touching the crypto itself and we’re not the custodian for the crypto. We’re facilitating the payments…. But I wanted to go back to what I was saying at the very beginning. We take a minority of the accounts that apply to us because we go through a vetting process that is substantial so to get into the gated community does require you to have certain financial wherewithal and to be a solid citizen.

Despite this strict vetting, the above Motley Fool analysis suggests Signet had over 1000 customers by Q4 2021. According to the interview with Shay in June 2021 Signet had at least 740 crypto customers:

INTERVIEWER: You have about 740 digital currency exchanges as customers? Is that about right?

SHAY: Yes, we’re growing about as fast as we can do it on Signet.

Basically, once you get past the initial “due diligence” and KYC, you’re considered clean and free to do as you like. Transactions hosted by the Signet blockchain are peer-to-peer with, apparently, minimal oversight.

While Shay compares Signet to a walled garden, here’s a better analogy: It’s like a basement nightclub. Once you get past the bouncer outside, you can party however you like. The drinks are free, the ceilings are mirrored, all your friends are there, and the best part is: No one is watching.

What could go wrong?

Well, it turns out that Shay‘s walled garden ended up infested with snakes. FTX’s bankruptcy filings, we see that multiple FTX shell corporations had banking relationships with Signature. Notably, Alameda Research passed Signet’s stringent door check:

And, the main FTX exchange integrated Signet services in October 2021:

It’s interesting to note that this legal filing lists Alameda as holding a Signet account, while the other shell companies do not. FTX advertised being integrated with Signet. It seems possible that, like Silvergate, Signature was enabling dollars intended for FTX to flow to Alameda through its private blockchain.

Signature has collaborated with other questionable projects. One example is the stablecoin TUSD (True USD). A relatively small stablecoin by market cap, TUSD has close ties to both Alameda Research and an infamous character named Justin Sun. Justin Sun’s notable characteristics include his frequent harrowing experiences at the hands of law enforcement and his habit of collecting bank accounts like baseball cards.

As shown by the excellent DataFinnovation, a large portion of TUSD “burn” volume (aka, redeeming the stablecoins for real dollars) was performed by just two entities: Alameda Research and Justin Sun. It’s interesting to note that another big user of TUSD was the infamous “sifu,” a convicted scammer with close ties to the QuadrigaCX exchange fraud

Now, consider the hundreds of billions of dollars in transactions hosted on the Signet blockchain and who was using that blockchain. We have to believe that regulators will take an interest in this product. Indeed, according to the press release announcing that New York state regulators had approved the creation of Signet, one of the stipulations was that Signature:

Implement,monitor and update effective risk-based controls to prevent and respond to any potential or actual wrongful use of virtual currency, including but not limited to its use in illegal activity, market manipulation, or other similar misconduct, as required by DFS’s February 7, 2018, “Guidance on Prevention of Market Manipulation and Other Wrongful Activity”

Signature may have enabled USD transfers to Binance through a defunct Seychelles shell company

Recent work by Deltec’d, a researcher whose previous work has exposed details about Tether’s banking relationships, discovered interesting ties between Binance, Silvergate Bank, Signature Bank, and a Seychelles shell corporation. Between December 2020 to May 2021, Binance used Silvergate to process USD transfers from customers. Notably, when a customer sent dollars to Binance, the name on the recipient account was not Binance. Instead, the account was registered to “Key Vision Development Limited,” a Seychelles-registered shell company. In May 2021, Silvergate apparently bowed to regulatory pressure when it suddenly severed ties with Binance. By September 2021, the heat was so intense that Key Vision Development, along with a company called “Binance Investments Co., LTD.” were struck from the Seychelles register of companies.

Deltec’d discovered that Binance may have continued to use Key Vision Development as a front company. However, in place of Silvergate it appears that Signature Bank may have become Binance’s new favorite bank. Deltec’d found two independently-created YouTube tutorials from January and June of 2022 that provided instructions for depositing dollars to Binance. In both instances, the videos included screenshots from the transfer page that showed Signature Bank listed as the recipient bank, with Key Vision Development as the beneficiary:

As noted by Deltec’d:

This is either negligence at best, or worse, intentional blindness on the part of Signature Bank, as news surrounding the phony Binance shell company “Key Vision Development Limited” has been in the public domain since at least June of 2021. Keisha Hutchinson is the Chief Risk Officer of Signature Bank. The Office of the Comptroller of the Currency (OCC) is the bank’s main regulator.

Of course, it is possible that two independent YouTube video creators separately forged this information six months apart for some reason. We can’t fathom why this might be, but maybe we should give Signature the benefit of the doubt.

We think they will be needing it.

* We were short SBNY since mid-2022 via far OTM puts. We closed that position late last year for a profit and have now opened a new position. Again, do not construe anything in this article as investment advice!

For a brief time, Dr. Ruja Ignatova was one of the most well-recognized figures in the cryptocurrency industry. Her product, OneCoin, was advertised as the “Bitcoin killer.” Using multi-level marketing (MLM) tactics, OneCoin managed to pull in billions of dollars from investors over a couple of years. Unfortunately, there was a major problem with Ruja’s narrative: OneCoin had never actually created any blockchain technology. It turned out that the tokens they were selling didn’t even exist in the ephemeral “it’s on-chain” sense; these were literally nothing more than numbers on a screen.

Of course, crypto detractors would argue that there is little difference between the OneCoin scam and other cryptocurrency offerings. In both instances, investors receive nothing more than digital trinkets with no claim of practical significance. However, it is fair to say that blockchains offer certain advantages. A blockchain is a decentralized and immutable record of every transaction completed on the chain, allowing for a high degree of confidence in the records on said chain. Users of the blockchain can trust that the records are accurate because no one entity controls the records and it is impossible to alter those records. At a minimum, when purchasing a “real” blockchain token you at least know your asset is being tracked on a secure and accurate ledger.

The most egregious part of the OneCoin scam wasn’t the standard “fraud” and “pyramid scheme” aspects that are shared with so many other crypto products. It was the fact that OneCoin didn’t even meet the minimal standard of selling a “real” cryptocurrency.

In 2019, Binance created its own alternative to compete with the dominant Ethereum blockchain. Binance copied the code from two previous blockchains, Cosmos and Ethereum, to create an integrated pair of chains commonly referred to as the “Binance Smart Chain.” The Binance Smart Chain is “proof-of-stake,” meaning that validators (the transaction processors/recorders) must buy and “stake” the blockchain’s governance token to become validators and receive transaction fees. One chain, called the Beacon chain, serves as the “governance” portion of the Binance system. The second chain, the BNB Smart Chain, hosts smart contracts and the majority of the actual activity running through the Binance chains.

This might seem complicated. A “tradfi” way to think of it: Being a validator is like owning stock in a company. To get dividends from the company, you must also lock your shares up in an escrow account (“governance”).

Binance issued the “BNB” token to serve as the governance token for validators on the Binance Smart Chain. Subsequently, BNB’s price skyrocketed with the market cap for the token maxing out around $110 BILLION in 2021. Today, BNB is roughly 62% below its all-time high. While this might sound bad, BNB has actually outperformed most other cryptocurrencies. For example, Bitcoin is 76% off its ATH, while Ether is 74% off ATH.

The Binance Smart Chain and BNB are cornerstones of the Binance empire. However, recent analyses have called almost every aspect of this blockchain into question. It turns out that, like many things with Binance, a closer look reveals cracks within the façade. The vast majority of BNB tokens appear to be owned directly by Binance, and market analysis suggests that the price has been artifically inflated. Billions of dollars in purported stablecoins pegged to the U.S. dollar on the BSC were not backed with real assets for weeks at a time. The code base for BSC is not open source and appears to be controlled directly by Binance employees. And most importantly, a deep dive into the Binance Smart Chain suggests that it might not function like a blockchain at all…

Binance owns 70-80% of BNB market cap, and the price appears to be manipulated

BNB is the fifth-largest cryptocurrency with a market cap of $42 billion. Based on Binance’s own public records, they directly own between 70-80% of the total BNB. The blockchain analyst @cryptohippo65 examined Binance’s proof of reserves information to determine the allocation of BNB across both Ethereum and Binance blockchains. Cryptohippo65 discovered that the vast majority of BNB on Ethereum and the BSC were likely attributable to customer holdings. This accounted for around 15% of the circulating supply:

However, nearly all of the BNB on the “governance” chain for the Binance blockchain, called the Beacon chain, appears to be owned directly by Binance. This can be determined by a simple process of elimination: Binance does not include these addresses in their customer proof of reserves address list, yet they clearly control these addresses.

This means that Binance is holding somewhere between $28-32 billion worth of BNB on its balance sheet. Yet BNB’s price is not determined independently of Binance itself, as Binance (unsurprisingly) hosts the largest trading pairs for BNB. Notably, the next-largest spot pairs are hosted on relatively small and questionable exchanges:

Based on data from the last 30 days, the ratio of daily spot trading volume to market cap for BNB was roughly 1%. This is significantly lower than the average ratio for Bitcoin (5.4%) or Ether (3.0%), indicating that BNB liquidity is markedly lower than other major cryptocurrencies. The true BNB volume is likely much lower since a large fraction of this alleged volume is reported by highly questionable microexchanges.

Thus, like the infamous FTT token that destroyed FTX, one should question whether BNB’s price reflects reality. With Binance holding the vast majority of tokens on its balance sheet, and the majority of trustworthy volume hosted on its own exchange, how likely is it that Binance could actually sell a significant portion of its BNB for dollars without crashing its price? These data indicate that BNB is just another stupid flywheel, like FTT or CEL.

Additionally, many onlookers have questioned the price behavior of BNB. The journalist and researcher Dylan LeClair has observed that the price of BNB skyrocketed in 2021 in an up-only pattern that appeared driven by a sudden and massive increase in “people” buying perpetual futures contracts on the price of BNB:

LeClair has also noted an, um, interesting correlation between the price of BNB and FTT:

Finally, cryptocurrency proponents tout decentralization as a core value of blockchain technology. However, Binance controls the vast majority of BNB on the BSC governance chain. Since BSC operates under a modified proof-of-stake validation mechanism, this means that control of the BSC is centralized in the hands of Binance itself. What’s the point of a centralized blockchain?

BSC stablecoins were printed from thin air

Binance’s branded stablecoin, BUSD, is issued by a New York-based company called Paxos. As we previously reported, Paxos provides relatively good documentation of the reserves backing BUSD.

However, Binance also issues its own derivative form of BUSD on the Binance Smart Chain called peg-BUSD. To do this, Binance claims to hold an equivalent number of Ethereum chain BUSD to “back” the derivative pegged token. Consequently, the number of tokens held in their peg reserve wallet should equal the number of tokens issued on the Binance Smart Chain. Currently, there are over $5 billion in peg-BUSD on the BSC. These appear to be 100% backed today.

However, the blockchain analyst DataFinnovation went back in history to examine these peg-BUSD tokens. When he tried to match the number of pegged tokens to the Ethereum BUSD held in reserve, DataFinnovation discovered that the Binance backing wallet frequently ran at a large deficit for weeks at a time:

In other words, Binance had printed dollar equivalents from thin air. As DF notes, at a minimum this suggests incredible disorganization at Binance. DF also noted something interesting: the periods where pegged BUSD was unbacked correlated neatly with periods of time when BNB prices skyrocketed. It is almost as if Binance needed the money to raise the price of BNB…

The code operating the Beacon chain is not open source… and it might not even be a blockchain

A couple weeks ago, blockchain researcher @cryptohippo65 went digging around in the BSC explorer and discovered an interesting anomaly: There was an address holding some 22 million BNB ($5.7 billion), but there was no record of how the BNB had arrived in this address:

The missing data was attributed to an “imperfect explorer” by a Twitter user claiming to be the “Chief Scientist” for the BSC:

To check this, DataFinnovation took the step of creating his own BSC “node” and attempted to download every transaction ever performed by the Beacon governance chain. However, he ran into some interesting problems when he tried this. His attempts encountered multiple error messages that prevented a full download of the record:

panic: Failed to process committed block (285268100:BE648E40618C858CD5FEB6D83517121BAF0F9624DE7A2A6666BD5E12F8C9BB34): Wrong Block.Header.AppHash. Expected 44D7905CE27CD8035800CB05689C59FF2577F6B1A2545DDFD74B5FDEA3F8F584, got 872C99D77FB32857030F253947EC17F29A12536056F93B64F299D2E7FB24DE46

He discovered that the downloads were breaking at blocks generated near 00:00 every day.

In his excellent summary of DataFinnovation’s recent work, Patrick Tan notes the coincidence that:

Binance, the centralized cryptocurrency exchange resets its price candles at the same time everyday.

In other words, the immutable chain linking every transaction appears to mysteriously break every 24 hours. This is a problem that simply should not happen if the Beacon chain is a true blockchain. And, importantly, this error suggested that the Beacon chain must have a workaround to repair this daily breaking point.

When trying to find a solution to this problem, the BNB “chief scientist” shared a Gihub code repository for the Beacon chain. It was notable that this relevant code was added to the repository only a couple hours before he shared it on Twitter. When DataFinnovation asked about this odd fact, the chief scientist stopped responding to the thread:

This means that key information required to use the Beacon chain was not shared with the general community until people went asking for it. This is not an open source project!

After receiving this code, DF stumbled on a tool in the Beacon chain code called “state recover.” This tool allows people trying to download all transactions to bypass the errors by retroactively re-writing the history of the blockchain. This violates the core principle of a blockchain, which is maintaining an immutable record of all transactions.

As DF says, tongue-in-cheek:

If your blockchain has a “state recover tool” to rearrange hashes it may not be a blockchain. Similarly folks have been reporting problems with AppHash for years. Were we not already successfully running nodes on TRON, Huobi Eco Chain and other, um, projects with limited documentation we probably would have given up. Alas here we are.

Consequently, BSC is not a blockchain in any meaningful sense. As DF points out:

If this thing is not really a blockchain it means whoever is repairing these hashes is operating the system. We can debate how and to what degree Bitcoin, Ethereum and other blockchains are decentralized. But nobody there is repairing hashes looking backwards whereas here things look decidedly less like Satoshi’s vision.

Subsequently, the “chief scientist” reported that they had fixed this error. How they did it is still undetermined…

Is BNB just OneCoin with extra steps?

The value of BNB is, in theory, derived from its use case as the “stock” of the Binance blockchain. We showed above that, like FTT or CEL, BNB ownership is highly concentrated in the hands of Binance itself. In yet another flywheel scheme, Binance appears to have spun up tens of billions of dollars in free assets on paper. We don’t know if Binance has leveraged these tokens; their CEO insists that Binance has no loans. Regardless, it’s clear that the BNB held on Binance’s books are worth far less than what current market prices suggest.

As we have demonstrated, there is substantial evidence that there are major problems with the Binance Smart Chains as well. These include hypercentralization of chain governance in the hands of Binance, periodically unbacked stablecoins, and a closed-end project under the control of a shadow group tied to Binance. Most importantly, DataFinnovation’s analyses suggest that the BSC does not operate like a proper blockchain.

These problems suggest that BNB is little better than OneCoin. Sure, there’s a blockchain underlying BNB, but that blockchain bears no resemblance to the type of decentralized and trustless technology that attracts cryptocurrency advocates. As Satoshi Nakamoto himself said:

Digital signatures provide part of the solution, but the main benefits are lost if a trusted third party is still required to prevent double-spending.

If you need to trust CZ to move your money, wouldn’t you be better off just using a regular bank?

There can be a thin line between trading and stealing. A trader’s goal is to exchange something for more than what they paid for it. In a ruthlessly efficient market, a trader has to capitalize on asymmetries between the information they possess and the information available to their counterparties. The greater the asymmetry, the greater the trader's opportunity to profit. The age-old question for traders and regulators is: What is the point where the asymmetry becomes so great between two parties that a trade is no longer just a trade, but theft?

A cryptocurrency trader named Avraham Eisenberg chose to walk the line between trading and stealing, and allegedly crossed that line. He publicly bragged about executing risk-free trades and openly admitted to using clever tricks to loot his targets. He believed in the crypto ethos of "code is law," that any action within the marketplace is permissible as long as you are clever enough. However, he eventually discovered that all trades have embedded risks, and that "code is law" only holds until the cops show up.

This is the story of Risk-Free Avi.

Avraham Eisenberg is a motivated guy. While completing a bachelor's degree in mathematics at Yeshiva University, Avi was a member of the debate team and occasionally wrote for the school paper. In what appears to be ironic foreshadowing, Avi listed his intellectual interests on a Yeshiva profile as "epistemology," "philosophy of science," and "applied ethics." 

While completing his undergraduate studies, Avi simultaneously founded and operated his own company. Thimes Solution, Inc (TSI), was an Amazon-based reseller of various products. According to a lawsuit filed by TSI in 2020, it was a small but successful company with over $300,000 in profits annually. However, TSI was subsequently accused of selling counterfeit products by a Chinese WiFi manufacturing firm called TP-Link. TSI was banned from selling on Amazon and the business collapsed. TSI subsequently sued TP-Link, alleging that TP-Link had fraudulently alleged counterfeiting to remove a competitive product reseller from the market. Unfortunately for Avi and TSI, the lawsuit was dismissed. It appears that TSI formally ceased doing business sometime in 2020. 

The suit against TP-Link was not Avi's first experience with civil litigation. He had previously sued the town of Clarkston, NY for negligence after he slipped and fell on ice.  Like the lawsuit against TP-Link, his personal injury case was eventually discontinued with prejudice in 2019. 

With the failure of TSI and his lawsuit against the town of Clarkston, Avi went in search of more profitable pastures. Sometime in 2020 or 2021, Avi began trading crypto. In July 2021, he created his "DeepFiValue" Substack blog, which promised "deep dives into cryptonomics." His first article, "Anatomy of a Yield Farm," is an excellent analysis of how decentralized finance (DeFi) protocols generate yield. In his explanation, Avi acknowledges that the vast majority of these protocols are doomed to failure by nature of their design:

Usually what happens is the token jumps a lot initially, then slowly declines as rewards get sold off, until eventually the token isn’t worth enough for people to think it’s worth continuing to “farm” it, and they exit. This is ultimately a zero sum game; all money being made by anyone here comes at the expense of others who played it wrong.

Avi later (in)famously wrote an article titled "How our team makes millions in crypto risk-free." In this piece, Avi explains two strategies that he had used to make several million dollars. In one instance, he used bots to mass-purchase NFTs by "spam[ming] transactions with minimal fees right when the project launched." In another strategy, he borrowed a large amount of the rebase token Amplforth, taking advantage of a differential between the borrowing rate and the rewards distributed to holders of the AMPL token. In both cases, these appear to have been legal trades. While many cried foul at his use of bots to "spam" NFT auctions, it does not appear that this was illegal.

However, Avi did not restrict himself to legal and "risk-free" trading opportunities like these. He ran into some trouble in February 2022 due to his relationship with a "decentralized autonomous organization (DAO)" called Fortress DAO. You can think of a DAO like a joint-stock corporation, except one that operates without any of the legal advantages of incorporation and uses blockchain tokens to settle questions about governance. DAOs pool assets from users to execute various strategies. One well-known example is "Constitution DAO," a DAO that attempted to buy a copy of the U.S. Constitution that was being auctioned by Sotheby's. 

Avi was one of the main developers of the Fortress project. He eventually ended up essentially controlling the main wallet holding the DAO's pooled assets. He created his own "stablecoin" called FUSD, then was able to ram through a proposal to convert all of Fortress' funds, some $14 million, into FUSD.  Avi said this was for the good of everyone, as FUSD was "fully backed." He then deployed the assets in a variety of "yield-farming strategies." Understandably, the members of Fortress DAO cried foul at this move. However, since Fortress DAO's design did not actually provide token holders with real power, they were stuck howling into the wind as Avi made off with their funds. Again, Avi had taken advantage of the lack of regulatory oversight to engage in tactics that would be unacceptable in a regulated market.

Despite his questionable practices, it wasn't until October that Avi finally made headlines after he targeted a mid-sized decentralized exchange platform called Mango Markets. Mango enabled users to trade cryptocurrencies and issued its own token, $MNGO, to act as a "utility token" within the market. In addition to "spot" trading (buying and selling “real” cryptocurrencies), Mango enabled trading in perpetual futures contracts betting on the price of the MNGO token.

Mango also allowed users to borrow funds from their platform, using the user's account balance as collateral. Unfortunately for Mango, they allowed ALL assets held in the account to be used as collateral. This included the value of perpetual futures issued on the platform. When Risk-Free Avi discovered this set-up, he moved quickly to exploit it.

Avi's scheme was relatively simple. He first created two accounts on the Mango platform and deposited several million dollars' worth of the USDC stablecoin to each account. He then sold perpetual futures contracts on the MNGO price to Account #1 from Account #2. He was therefore able to make a huge bet on $MNGO price going up without spending more than transaction fees. Next, he proceeded to make large spot purchases of MNGO using both Mango and accounts on two other exchanges. The price of MNGO jumped. As a consequence, the value of Avi's perpetual futures in Account #1 spiked 1300%, taking the value from $18.5 million to $260 million.

Using his futures contracts as collateral, Avi then borrowed essentially all of the available funds held by Mango in a few minutes, a total of some $117 million worth of USDC ($52.8 mil), wBTC, USDT, SOL, and SRM. He then transferred the "borrowed" funds off-platform to another wallet. Of course, it isn't really borrowing when you never intend to pay the money back...

In other words: Avi made a big bet on the MNGO token price, then manipulated that price, and then used the artificially inflated value of his bet to “borrow” $117 million.

Finally, Avi sold the MNGO tokens he had accumulated, and the price collapsed. The value of the futures contracts in his Mango account collapsed as well, leading to a margin call on Account #1. Of course, he had already sucked all of the money out of the platform so the attempted liquidation failed to recoup any losses. 

Blockchain sleuths rapidly discovered that Avi was behind the heist. After being outed, Avi posted an infamous Twitter thread in which he referred to his scheme as a “highly profitable trading strategy:”

While many asserted that he would face legal action for his actions, Avi seemed unconcerned. He asserted that his actions were “legal open market actions” because he had “us[ed] the protocol as designed.” After all, code is law, and since crypto was unregulated he figured he would be fine. Eventually, he settled for repaying $67 million from his haul to "make users whole." A cool $50 million for a few hours of risk-free work, and Avi had entered the crypto trading history books.

However, just two months later Risk-Free Avi discovered that there had been risk in his actions after all. He was arrested in Puerto Rico and charged with commodities fraud and manipulation in relation to the Mango exploit. He is now waiting to stand trial.

The story of Risk-Free Avi is a case study for cryptocurrency as a whole. The space has capitalized on a perceived lack of legal clarity to perform what some playfully call "regulatory arbitrage." People routinely make unregistered securities offerings, sell unregistered investment products, and engage in market manipulation tactics that have been illegal in U.S. markets since at least the 1930’s.

Avraham’s clever arrogance does not strike us as unique. Instead, Risk-Free Avi’s attitude mirrors the broader crypto community’s perspective. These folks remain infatuated with their ability to construct and exploit complicated Rube Goldberg-esque financial constructs while remaining blind to the externalities and hidden risks generated by their actions. Programmers who imagine they are philosophers, the crypto-conomists confuse technical skill with wisdom. Limited by simplistic understandings of law and economics, trapped by their ignorance and conceit, they fail to recognize that cleverness can only be a temporary refuge from reality.

For Avi, reality came in the form of handcuffs and a quick flight from Puerto Rico. And just as it came for Avi, reality is rushing forward to interrupt the crypto community’s convoluted dreams of perpetual financial motion and risk-free opportunity.

In the final days of the FTX collapse, onlookers wondered about the solvency of FTX’s U.S.-based exchange, FTX.US. FTX.US was ostensibly held at arms length from the parent exchange. FTX leadership insisted that customers of the FTX.US division would be safe even if the parent company went under. However, when the end came for FTX, FTX.US met the same fate, freezing customer withdrawals and entering Chapter 11 with the rest of the FTX/Alameda network.

Despite being U.S.-regulated and theoretically walled off from FTX, FTX.US was in reality little more than an extension of its offshore owner. One might think that, perhaps, FTX.US was really just a ploy to trick U.S. regulators into focusing on the smaller American company instead of turning attention to the incoming financial hurricane in the Bahamas.

It turns out that FTX was not the only offshore exchange to create a U.S. based and regulated entity. Binance, the world’s largest exchange, created Binance.US in early 2019 in response to regulatory pressure. Binance.US was described as a separate entity from Binance that was merely licensing the name and certain features from the main company. Binance.US, based in Palo Alto, is licensed as a money services business in the United States. Note that it is not difficult to obtain these licenses, as we previously showed in our exposé of a network of fake crypto exchanges based in Colorado.

However, shortly after the creation of Binance.US, Forbes magazine published a report claiming that they had received a leaked document referred to as the “Tai Chi” document. According to this document, the Binance US exchange was a ploy to trick U.S. regulators into focusing on the compliant local exchange, while the parent exchange went free to do its own business. Binance responded by suing Forbes for defamation, only to drop the lawsuit a few months later. In February of this year Binance tried a different tack: they invested $200 million in Forbes’ parent company. If you can’t beat them, buy them!

However, this early reporting by Forbes was corroborated by a much more detailed report by Reuters in October 2022. With more sources and documents at their disposal, Reuters found essentially what the Forbes piece three years earlier suggested: Binance US was designed to trick regulators and U.S. customers:

It shows that in 2018, Zhao approved a plan by lieutenants to “insulate” Binance from scrutiny by U.S. authorities by setting up a new American exchange. The new exchange would draw regulators’ attention away from the main platform by serving as a “regulatory inquiry clearing house,” according to the proposal. Executives went on to set the plan in motion, company messages show.

In public, Zhao said the new U.S. exchange – called Binance.US – was a “fully independent entity.” In reality, Zhao controlled Binance.US, directing its management from abroad, according to regulatory filings from 2020, company messages and interviews with former team members. An adviser, in a message to Binance executives, described the U.S. exchange as a “de facto subsidiary.”

These problems, in addition to other legal issues at Binance, may explain Binance.US’s repeated trouble with their executive leadership. Binance.US’ first CEO, a young woman named Catherine Coley, led the firm from 2019 to June of 2021, when it was announced that the former Comptroller of the Currency Brian Brooks would be taking over as CEO.

Coley, a very public and vocal person during her time at Binance, seems to have disappeared after leaving Binance.US. While her social media accounts are still online, she does not appear to have made any posts since mid-2021. Her LinkedIn page has not been updated, with her last job listed as her role as Binance.US CEO. As far as we are aware, no one has ever publicly disclosed where Coley ended up after she left Binance.US.

Their second CEO, Mr. Brooks, lasted at the company for about four months before abruptly resigning.

These public issues have led many to wonder whether Binance and Binance.US are truly separate entities. We can now report that based on blockchain transfers, market data, and company disclosures, it appears that there is no meaningful separation between the two firms. In fact, we show that Binance.US both transfers customer deposits to Binance and pays customer withdrawals using transfers back from the offshore exchange’s wallets. Further, we demonstrate that trades allegedly happening on Binance.US’s exchange are likely being conducted directly on the main Binance exchange.

Binance and Binance.US have transferred billions of dollars in crypto between each other

Yesterday, Binance US temporarily halted withdrawals of the Tether stablecoin (USDT). USDT, along with other stablecoins like USDC and Binance USD (BUSD), are dollar equivalent tokens on the blockchain backed by real dollar assets (in theory). It turned out that Binance US apparently didn’t have enough USDT in its wallets to pay back customers for several hours. The USDT balance in the main Binance US wallet dropped to its lowest level ever ($197,000) during this time period.

Twitter user @jconorgrogan was one of several people live-tracking the Binance.US withdrawal freeze. He noted that withdrawals restarted after Binance.US received a single transfer of $10 million USDT from an unidentified address. In turn, those funds had been pulled from two known Binance exchange wallets:

This did not gain as much attention as it should have. Remember, Binance and Binance.US are supposedly separate entities. However, Binance.US apparently had to pull money from the main Binance exchange to pay back customer withdrawals. In other words, Binance.US customers were paid back using funds transferred from the offshore Binance exchange! We must ask, why were U.S. customer assets held in Binance addresses?

We examined this intermediary transfer address in more detail. This address behaves like what some blockchain analysts call a “rail,” an address used to move funds between main wallets. In this case, this address appears to have only one function: transferring assets from the main Binance exchange wallets to Binance.US. Since the creation of this wallet in July of 2020, it has moved over $1.4 BILLION in Ether, USDT, USDC, and MATIC tokens from Binance exchange wallets to Binance.US:

After a little more digging, we identified a second address that does the opposite job: It exclusively handles transfers from Binance.US addresses to Binance exchange wallets. While this address has only been active since August 2021, it has handled over $1.9 BILLION in transfers from Binance.US to Binance. Notably, over $1.4 billion of this was in stablecoins ($1.2 billion USDT, $236 million USDC):

We performed some additional analyses showing that Binance exchange wallets received the largest amount of Binance.US transfers over these timeframes. In other words, Binance.US is sending customer funds to Binance. We conclude that a significant portion of Binance.US customer deposits are commingled with other deposits on Binance’s main exchange.

This revelation may explains the disconnect between Binance.US wallet holdings and the reported daily trading volumes on this exchange. Binance.US’s known wallets hold a total of ~$70 million in assets today (12/17). According to market aggregator CoinGecko, total 24 hour trading volume was $146 million, or roughly twice the exchange balance. Compare this with the main Binance exchange. Over the last 24 hours, Binance had some $7.3 billion in total volume, while having a total exchange balance of somewhere around $57 billion dollars. This means the much larger and more popular Binance exchange had volumes that were roughly 13% of their exchange balance.

In other words, the reported ratio of (volume:exchange balance) on Binance.US was 15 times higher than that ratio on the main Binance exchange. We hypothesize this discrepancy is due to Binance.US holding large amounts of customer deposits on Binance and executing most, or all, customer trades directly on Binance’s exchange.

This hypothesis is supported by Binance.US’s terms of service, where the company admits that:

BAM appoints market makers, including Related Parties and market makers that are incorporated or otherwise operating outside of the United States, to promote liquidity and facilitate trading on the Platform…

And in a recent Twitter Spaces meeting, CZ publicly admitted that he is a major shareholder in a “market making” firm that does business on Binance. Incredibly, he followed this admission with the claim that his market making service “does not make profits” and simply operates to “provide liquidity” to the markets (fast forward to ~14 minute in):

Our data suggest that Binance.US’s “market maker” is a single pair of addresses that exclusively transfer funds between Binance and Binance.US. These addresses move customer assets from the U.S.-based exchange to the much larger offshore entity to perform trades. This means that for all practical purposes, there is no real difference between having your money with Binance.US or directly with Binance. Given that Binance was barred from doing business in the United States, it certainly appears that Binance.US is little more than a convenient fiction to evade regulators.

Conclusion

We believe that these simple analyses demonstrate that Binance.US customer funds are being sent to Binance and commingled with Binance customer assets. Our data also suggest that Binance.US is using Binance to perform customer trades while pretending to be an independent entity. In reality, Binance.US appears to be little more than a facade to obfuscate the fact that an unregulated offshore crypto business currently under investigation for money laundering and sanctions violations is doing business in the United States despite being banned from the country.

These findings neatly dovetail with the previous reports by Forbes and Reuters indicating that Binance.US was a clever trick designed to fool regulators and customers. However, with the collapse of FTX everyone is taking a closer look at the crypto industry. We doubt that Binance’s regulatory Tai Chi will allow them to evade the long arm of the law for much longer…

In 2001, after the collapse of the energy trading firm Enron, it was discovered that their auditing firm Arthur Andersen had failed to detect blatant fraud and malfeasance on the part of their client. Arthur Andersen subsequently folded after it was charged with complicity in one of the largest corporate frauds in history. The scandal led to reforms of corporate accounting laws in the U.S. through the passage of the Sarbanes-Oxley act.

It turned out that Enron was far from the only bad company on Arthur Anderson’s client list, as the firm ended up being involved in at least a dozen major corporate accounting scandals.

In theory, an external auditor provides independent assurance that a company’s financial statements are complete and accurate. By acting as an unbiased third party, the audit firm provides investors with some reassurance that the financial statements of a firm can be trusted. However, the history of finance is riddled with example after example of independent accounting firms that failed to live up to these expectations.

An accounting firm called Armanino LLP has been one of the most prominent and active accounting services for the crypto world. Armanino serves some of the biggest names in the business. Notably, Armanino was the auditor for FTX’s US division and gave the company a clean bill of health. Of course, this was only one entity within the agglomeration of dozens of entities within the FTX/Alameda network. Armanino asserts that this was a perfectly valid audit that was limited in scope to a single entity. Consequently, they have argued it would have been impossible for Armanino to detect the wider fraud present throughout the FTX conglomerate.

While this may be true, it turns out that FTX isn’t the only questionable crypto client of Armanino.

While Armanino provides audit services, it is their “attestation” services that have been particularly popular among cryptocurrency firms. Attestations are a more limited examination of a company’s books than an audit. While an audit includes a formal opinion and detailed validation of a company’s financial claims, attestations only perform limited procedures that basically check that information provided by management matches the claims made by management.

For example, let’s say a company claims to have a bank account with $5,000 deposited. An auditor would independently request records from the bank confirming this deposit exists. If performing an attestation, the accountant merely compares management’s claim to documentation provided by management, then says “yep, these numbers match!”

Doesn’t seem very helpful, right? Especially if, say, management is lying about their books.

Armanino’s attestations have come under scrutiny recently from regulators and researchers. Let’s take a look at one example: Armanino’s relationship with the crypto lending firm Nexo and the use of their “real-time attestation.”

Nexo and Armanino’s Real-Time Attestation gimmick

Armanino’s flagship service is their “real-time attestation,” a service which “is the world's first application that provides independent accountant reports in real time.” Armanino generates daily reports that purport to increase visibility into their client’s financial health to provide “unparallelled transparency.”

One of the clients using this product is the crypto lending firm Nexo. Nexo is the “last man standing” of the crypto lending industry after the failures of all of its major competitors including Celsius Network, BlockFi, and Voyager Digital. Nexo claims to have over $2 billion in crypto assets under management and claims to be in good financial health.

Armanino’s site includes some strong assertions about Nexo’s balance sheet. For example, their Nexo attestation page includes a large plug-in stating that the firm’s liabilities are overcollateralized “100%+” with a checkmark next to the phrase “Fully Backed.”

However, a closer look at the Armanino attestation identifies several major flaws with this process. First, their attestation says nothing about the net equity position of the firm in question. In the most extreme case, Nexo could have $2,464,203,913 in liabilities and $2,464,203,913.01 in assets, and still be considered to have a collateral ratio of “100%+”.

Second, this analysis does not compare which assets Nexo holds to the liabilities it owes. In September 2022, multiple states filed cease and desist orders against Nexo. Among these orders, Kentucky state securities regulators who saw Nexo’s books asserted that Nexo is actually insolvent without including their ownership of NEXO tokens. NEXO tokens are their proprietary cryptocurrency, like FTX’s “FTT”tokens that got Sam Bankman-Fried into so much trouble. As we showed back in September, NEXO tokens suffer from many of the same problems as FTT. They are highly illiquid and their ownership is almost entirely concentrated in the hands of Nexo itself. We also demonstrated very questionable trading patterns concerning for wash trading inflating the already anemic markets for this token.

Third, Armanino obtains all of the data regarding customer deposits and Nexo’s loan book via API from Nexo. Armanino does not independently verify these numbers; they merely trust that the numbers provided by Nexo are accurate. More importantly, there is no attempt by Armanino to investigate the true value of Nexo’s loan book or their method for valuing these loans on their balance sheet.

Why is this a problem? We have no idea how Nexo values its loan book, or what loss provisions they have accounted for. Given that Nexo is lending in the highly volatile cryptocurrency world, the likelihood of counterparty failure is quite high. For example, Celsius Network’s loss provisions on its loan book are now over 50% according to their Chapter 11 filings. Without an understanding of what the quality of these loans are, Armanino’s report simply trusts that Nexo is fairly valuing these assets.

Nexo’s use of Armanino’s attestations has been directly called out by regulators, who have complained that these attestations provide insufficient information to be useful for either regulators or investors. Despite these complaints, Nexo persistently and misleadingly refers to these attestations as audits in public statements. As noted by a cease and desist order against Nexo from the State of Vermont:

Despite representations by Nexo, the data and figures set forth in the Armanino report contain several material shortcomings… includ[ing]: (1) failure to identify or account for non-customer liabilities that may be substantial and material… (3) failure to identify or account for reserves for doubtful loan accounts (e.g. for obligations of distressed borrowers or non-performing loans.

It’s worth noting that less than two weeks ago, Nexo announced that they will be leaving the United States due to a “lack of regulatory clarity.”

Armanino quits the crypto business

So to summarize, one of Armanino’s main products is the “attestation.” Since attestation procedures do not include much verification of management’s claims, these attestations are essentially worthless from the perspective of an investor. Despite this fundamental uselessness, it turns out that the majority of crypto firms (including all three of the largest stablecoins) rely on attestations to “prove” their financial health.

If an attestation doesn’t provide sufficient information to evaluate a company’s financial claims, what is the point? Are attestations just a ruse to confuse prospective investors into thinking the due diligence has been done?

It’s worth noting, of course, that we are not accusing Armanino of doing anything illegal. It might not be fair to compare this firm to Arthur Andersen, which engaged in egregiously bad conduct prior to their collapse. However, we wonder about the ethics of issuing confusing and limited analyses like attestations to the public. We also wonder what liability a firm like Armanino has if, say, they issue a statement on their website with a checkmark by “100%+” collateralization and it turns out their client was not actually solvent.

As we were putting the finishing touches on this piece, we were shocked when we discovered an article by Forbes on December 15th stating that Armanino is planning to close its crypto auditing practice in the wake of the FTX failure. This article speculates that Armanino was stopping its involvement in crypto “under pressure from Armanino’s non-crypto clients” who might be worried about the “reputational risk” the firm faces from doing business with crypto companies.

We wonder if there may be other possible explanations for this hasty exit, but we will leave speculation to others.

Armanino managed to miss one of the biggest corporate frauds in history despite performing a full audit. What questionable activity are they missing by performing limited attestation engagements? And what culpability does the firm share when they fail to publicly address their clients repeatedly misrepresenting their limited services as “audits?”

We have lots of questions, and few answers. All we know is, we are likely to be finding out those answers sooner rather than later.

Every day there are new revelations about Sam Bankman-Fried’s FTX/ Alameda Research crypto conglomerate. As a refresher, Sam first founded Alameda Research in 2017 as a “crypto hedge fund.” The FTX exchange was subsequently started in 2019. Both firms were based in Hong Kong until 2021, when SBF abruptly moved most of his operations to the Bahamas. However, he maintained close ties to Hong Kong through several subsidiaries and related companies, including an over-the-counter cryptocurrency exchange called Genesis Block.

The Financial Times recently published an excellent report detailing the close ties between Alameda Research and Genesis Block. Genesis Block had a unique business model: It exchanged bags of cash for cryptocurrency.

At the time, Genesis Block was drawing a crowd with its unusual business model: in a world dominated by the web, it was exchanging crypto for physical cash. “People were literally lining up around the corner with bags of cash at Genesis Block,” a former employee said. “Sometimes they shut the door saying they were out of bitcoin.”

Genesis Block also had an innovative approach to banking:

According to Yang, Genesis Block had a “network” of 50 to 100 linked bank accounts, which people familiar with the company said would have been attractive for Alameda as it offered an “on and off ramp” to hard currency. “[We] have a whole network of what we call satellite bank accounts in our control . . . It’s a very grey area, I’m not going to lie. It could sound shady to some people,” Yang said on the podcast.

As FT reporting and a review of public records demonstrates, Genesis Block and Alameda were very closely tied. Both firms started in 2017; both attributed their initial successes to trading the “Kimchi Premium,” a borderline-illegal scheme that capitalized on the difference in Bitcoin prices between Japan, Korea, and the rest of the world. Alameda was a shareholder in Genesis Block, and the two companies shared both leadership and physical office space:

At the time of FTX’s crash, the companies shared the same Hong Kong office block. Cottonwood Grove, a subsidiary wholly owned by Alameda Research, was registered a floor below Genesis Block’s Wan Chai offices. Genesis Block co-founder Clement Ip was a director of FTX’s Hong Kong business, while Charles Yang’s LinkedIn shows him as a partner at Genesis Block. He appeared at events this year as an Alameda Research “principal”. Two people familiar with Genesis Block operations described the company, which also ran a network of bitcoin ATMs across Asia, as being integrated into FTX and Alameda… Some Genesis Block compliance employees and traders also went to work directly for FTX.

While the FT cited insiders who described the company as being “integrated” into FTX/Alameda operations, the extent of that integration was not revealed. Based on new information we have obtained, we can shed light on this relationship: Blockchain transfers suggest Genesis Block was little more than a nameplate, as the funds transferred to Genesis Block appear to have flowed directly to Alameda Research.

Transfers “to Genesis Block” went directly to Alameda Research wallets

Recently, a former Genesis Block customer reached out to Dirty Bubble Media and shared records of over two dozen transactions between themselves and Genesis Block. Over the past two years, this customer had sold thousands of dollars in Ether, Tether stablecoins (USDT), and Circle stablecoins (USDC) to Genesis Block for fiat currency, which was then wired to their bank account. After Genesis Block closed its business in the wake of the FTX failure, this customer had gone back to these records to see where the crypto went after it was sold to Genesis Block. And they found something amazing:

Every single transfer was swept directly into one of two wallets that belonged to Alameda Research.

These addresses were independently verified as belonging to Alameda by both Larry Cermack and by a group of blockchain researchers led by Matt Ranger.

We confirmed that Alameda’s addresses behaved like a customer-facing business by examining the entirety of flows through Alameda 27 over multiple time frames. The address acts as a hub, sending and receiving funds from dozens of other wallets. A priori, this is not what you would expect a hedge fund wallet to behave like:

In every instance we examined, the upstream wallets were originally funded by Alameda to cover transactional costs. This is a common strategy we have seen used by exchanges and other customer-facing blockchain firms, including FTX.

How much in transfers are we talking about? Between its creation in April 2021 to November 2022, Alameda 27 handled over $13 billion in transfers, mostly USDT, USDC, and Ether:

And Alameda 14 transferred over $11 billion between its creation in 2018 to the present:

Obviously, we can’t know for certain how many of these transfers are related to Genesis Block. However, we do note that there appear to be many, many wallets that follow an identical pattern to the one our source identified. It is also worth a reminder that this data only includes transfers on the Ethereum chain. Genesis Block’s business was largely based around exchanging Bitcoin for cash, suggesting that the total volume of this business could have been much larger than what we captured with our analyses.

This discovery highlights just how closely linked Genesis Block and Alameda really were. Based on our data, it appears that much (if not all) of the cryptocurrency ostensibly sent to Genesis Block was actually processed and received by Alameda. In other words, Genesis Block became little more than a customer-facing nameplate behind which Alameda conducted business.

Our findings suggest Alameda wasn’t just a hedge fund. It was acting as an OTC and payment processor for individuals in Hong Kong exchanging cash for cryptocurrency. It remains to be seen what role this exchange business played within the wider FTX/Alameda network…

Have you ever been in an arcade? To play the games hosted inside the arcade, you must first exchange your money for arcade tokens. These tokens act as dollar equivalents within the micro-economy of the arcade. At the end of your sojourn within the fantasyland of the arcade, you can (sometimes) sell your tokens back in exchange for real money.

Stablecoins are the crypto equivalent of an arcade token. In its simplest form, the stablecoin issuer accepts one unit of currency in exchange for a blockchain entry equal to that unit of currency. So, $1 is equivalent to 1 $USDC or 1 $USDT. Entities can then use these dollar equivalents to purchase other cryptocurrency directly on the blockchain or execute other trades, loans, transfers, etc.

In exchange for creating a blockchain-usable dollar equivalent, the stablecoin issuer gets to hold the real dollars and collect any interest earned on these assets. However, the issuer explicitly promises to hold all of these assets in safe and liquid assets to ensure that the value of their reserves always equals the value of the stablecoins they have issued. In other words, an stablecoin issuer should function like a simple money market fund.

There are three large stablecoins in the cryptocurrency market with a collective marketcap of $130 billion dollars. This is roughly 14% of the total cryptocurrency market cap. Together, these three stablecoins make up >99% of the liquidity within cryptocurrency markets.

Of these stablecoins, the Tether stablecoin is the largest with a current market capitalization of $65 billion, followed by Circle ($43 billion) and BUSD ($22 billion). By daily trading volume, Tether also (usually) dominates the market. Other than a brief period during the FTX failure when BUSD volume skyrocketed (???), Tether’s volume typically outpaces the other two stablecoins by several fold:

In other words, Tether serves as the primary source of dollar liquidity in cryptocurrency markets.

This raises an important question: What assets are backing these stablecoins? And is it possible that one of these stablecoins is not fully backed?

What’s backing each stablecoin?

USD Coin ($USDC):

USDC is issued by Circle Internet Financial, LLC, a U.S. based company licensed as a money transmitter. USDC has a current market capitalization of $43 billion. While Circle has never published an audited financial report, they do provide monthly “attestations” from their accounting firm, Grant Thorton. The most recent report, for October 31, 2022, shows that USDC is fully reserved primarily with Treasury securities (82%) and cash (18%). Circle asserts that all of their cash is held at “U.S.-regulated financial institutions:”

Note that the USDC attestation provides the Committee on Uniform Securities Identification Procedures number for each issue of Treasury securities purchased, along with the market value of each.

Despite the caveat that these statements are unaudited, Circle’s disclosure provides a fairly good level of detail about the assets backing their reserves. They hold a relatively simple mix of liquid and low-risk assets that would be easy to liquidate in case holders of their stablecoin wanted to redeem their dollars.

Binance USD ($BUSD):

While Binance USD has the name of the world’s largest exchange, the stablecoin is actually issued by the Paxos Trust Company, LLC, a New York-based financial firm primarily working with cryptocurrency. Paxos holds the reserves underlying BUSD, which currently has a market capitalization of $22 billion. Like USDC, Paxos issues unaudited monthly reports describing the reserve breakdown:

Based on their attestation from October 2022, BUSD was backed with a combination of US Treasury debt ($6.1 billion or 29% of market cap), Treasury Reverse Repurchase Agreements ($14.2 billion or 67% of market cap), and cash ($870 million or 4% of market cap).

Like USDC, Paxos reports that the cash portion of the funds are held at U.S. regulated banks. Again, the BUSD reports provide substantial detail about the reserves backing the stablecoin. And, like USDC, the composition of the stablecoin’s reserves is simple and composed entirely of low-risk assets.

Tether ($USDT):

The Tether stablecoin is both the oldest and largest stablecoin in the market. It is owned by the same folks that run the Bitfinex exchange, although ostensibly Tether and Bitfinex are separate entities. As we will show, the separation between these two firms is similar to the supposed separation between the FTX exchange and Alameda Research.

Unlike Circle and Paxos, which are both licensed to operate in the state of New York, Tether is specifically banned from doing business in New York. Tether had to pay $18 million in a settlement with the NY AG after it was proven that they had lied about the reserves backing USDT. It turns out that at several points throughout Tether’s history, their advertised 1:1 backing with U.S. dollars was a lie. Furthermore, Tether and Bitfinex frequently commingled assets, sharing funds to prevent insolvency.

Anyway, let’s forget about that totally irrelevant past and take a look at Tether’s most recent attestation, for September 30, 2022:

Gee, that sure looks a lot different from the financials released by Circle and Paxos, doesn’t it? Treasury bills and cash make up 67% of their reserves. Another $7.1 billion (10.3%) of the reserves are held in money market funds. Tether does not disclose the breakdown of which Treasury debt it owns or where they do their banking.

Notably, $11.9 billion (18%) of these reserves are attributed to “other investments,” “secured loans,” and “corporate bonds, funds, and precious metals.” Another $3 billion (4.4%) are held in “reverse repurchase agreements.” Unlike the reverse repo agreements listed on BUSD’s balance sheet, these are not Treasury-backed assets. Instead, these are:

agreements that have been entered into directly or indirectly by means of the purchase of structured notes or fund vehicles, where the ultimate issuer or guarantor of the agreement has a rating of A-2 or better.

Who are these secured loans to? We don’t know, because Tether doesn’t tell us. We know that at least one former creditor was the Celsius Network, which Tether ended up liquidating for >$900 million in June of 2022.

What are these loans secured with? We don’t know, because Tether doesn’t tell us. Based on their deal with Celsius, we know that Tether issued USDT based on Bitcoin-backed loans.

What assets make up Tether’s $2.6 billion in “other assets?” We don’t know, because Tether doesn’t tell us. A recent report from Semafor claims that some of these assets are venture capital investments Tether made in (likely worthless) companies:

It also owns $2.6 billion in “other investments,” according to the September report. It’s not totally clear what’s in them, but they are likely venture stakes in other crypto companies held by its owners and affiliates, according to a global investigations firm commissioned by a hedge fund betting against the price of Tether. Semafor reviewed the findings of its report that found Tether holds equity stakes in more than a dozen crypto startups.

Semafor was able to verify some but not others. We confirmed that the crypto exchange that owns Tether invested, either through itself or an affiliate, into: an online-betting site called Betfinex; Dazaar, a data-sharing service; Dusk Networks, whose software turns financial investments into tokens; a crypto trading platform called Rhino; Shape Shift, a crypto wallet; Blockstream, a blockchain infrastructure company; Netki, a digital-ID company; and Keet.io, a video-chat app.

Obviously, Tether’s disclosures and reserves strategy differs wildly from its major competitors. Their attestations don’t show anywhere near the same level of detail as either Circle or Paxos. Their strategy is far more complex and Tether admits to holding more risky assets on the balance sheet. And, it appears that at least some of Tether’s reserves are held in highly illiquid venture capital investments that may be worth significantly less than what Tether claims they are.

…wait, Tether admitted to lying about their reserves?

In 2021, Tether settled lawsuits by the New York state Attorney General (NYAG) and the Commodities and Futures Trading Commission (CFTC), paying $18 million and $41 million in fines respectively. In those settlements, it was proven that Tether had lied about the assets backing their token on multiple occasions. In fact, these settlements demonstrated that Tether was fully backed about 28% of the days over a several-year period. Per the NYAG statement about the settlement:

The OAG’s investigation found that, starting no later than mid-2017, Tether had no access to banking, anywhere in the world, and so for periods of time held no reserves to back tethers in circulation at the rate of one dollar for every tether, contrary to its representations.

One particularly egregious event disclosed in these settlements was in 2018. The Bitfinex exchange was using a Panama-based shadow bank called Crypto Capital Corp (CCC) to handle its funds. Notably, the deal between CCC and Tether did not include any written contract. Unfortuantely for Tether, CCC happened to also be doing business with the cartels. It was shut down by the U.S. DOJ and their assets were seized, including some $850 million in Bitfinex customer funds. To cover up the losses, Bitfinex moved Tether’s reserves to its own accounts:

On November 1, 2018, Tether publicized another self-proclaimed ‘verification’ of its cash reserve; this time at Deltec Bank & Trust Ltd. of the Bahamas. The announcement linked to a letter dated November 1, 2018, which stated that tethers were fully backed by cash, at one dollar for every one tether. However, the very next day, on November 2, 2018, Tether began to transfer funds out of its account, ultimately moving hundreds of millions of dollars from Tether’s bank accounts to Bitfinex’s accounts. And so, as of November 2, 2018 — one day after their latest ‘verification’ — tethers were again no longer backed one-to-one by U.S. dollars in a Tether bank account. 

Of course, this was the past. Although Tether and Bitfinex are still controlled by the same individuals, maybe they turned over a new leaf?

Perhaps not. Because, even if we take Tether’s current attestations at face value, their own numbers demonstrate that Tether has either been insolvent multiple times over the past year, or they have required recapitalization on multiple occasions!

As the inimitable software consultant and financial writer Patrick McKenzie explains:

The Consolidated Reserves Report alleges that Tether’s reserves included, as of September, $2,617,267,750 of “Other Investments (including digital tokens)” and $6,135,946,415 of Secured Loans.

These assets must have been impaired in the last six weeks. If they are not, Tether would have a legitimate claim to being the best risk managers. Not in crypto, no, in the history of the human race.

The risk-on assets are 12.86% of the reserves, via simple division. Their equity is 0.36% of assets. (No, I did not forget to multiply by a hundred when converting to percent.)

If their risk-on assets were impaired by more than about 2.86%, Tether must have (by their own numbers) needed recapitalization. Again.

Despite issuing loans to other crypto firms, Tether has somehow avoided losses on every single blowup over the past year, from 3AC to Celsius to FTX. This, despite the fact that Alameda Research was the largest recipent of USDT.

Tether’s motto: Trust, don’t verify.

Tether’s honesty and the funds backing their token have been called into question by many, including major media outlets. It would seem reasonable to ask these questions, given Tether’s extremely limited disclosures and history of lying about said reserves.

Instead of providing more information and clarity, Tether’s response to these questions always follows a similar pattern of hysterical denial and denunciation:

Now, call us skeptical, but wouldn’t it be easier to simply show us the money?