Crypto Customer-Asset Theft: The Custody Promise and the Permission to Take

Crypto exchange customer funds theft can start with an undisclosed permission to spend assets the platform promises to hold for customers. A customer sees a balance on a screen. At FTX, a related trading business had access to the money behind it. If you work in engineering, custody or finance, the permission you saw may explain how customer assets became someone else’s spending money.

FTX’s founder was convicted of fraud after a criminal trial. In its account of the criminal trial against FTX’s founder, the Justice Department described assurances that customer deposits stayed separate and would not be used by the exchange. The founder instead directed changes to the computer code that allowed Alameda Research, his trading business, to withdraw effectively unlimited cryptocurrency. Customers heard a custody promise. The code gave Alameda access.

Hidden Withdrawal Privileges Opened Customer Funds to Alameda

At a crypto exchange, hidden withdrawal privileges can give a favored account access to customer funds while other accounts face the advertised controls. The findings in the Commodity Futures Trading Commission’s consent order against FTX Trading and Alameda Research identify the exception precisely. Alameda’s account carried an “Allow Negative” flag that let it withdraw digital assets with a negative balance and exempted it from automatic liquidation.

The order also records a borrowing limit of $65 billion. That limit and the code exception let Alameda borrow and withdraw directly from FTX, while FTX promoted its automatic liquidation system as a feature that limited risk. We call that a safeguard with an exception for the business spending the customers’ money. Quite an exception.

FTX’s own customer terms, reproduced in the order, said:

The order found that customers neither authorized Alameda’s use of their assets nor knew about it. Alameda could reach digital assets in FTX’s online wallets through its own exchange account. For an engineer or custody employee, that connects the promise to an actual permission: whose account could withdraw, what balance it needed and which control the code bypassed.

FTX Credited the Customer While Alameda Held the Cash

FTX’s customer ledger could show a deposit even when the money remained in an Alameda bank account. The consent order found that, when FTX launched, it directed customers depositing ordinary currency to bank accounts owned and controlled by Alameda.

FTX staff credited the corresponding amount to the customer’s internal account. Customers could then see the deposit on the website or app, even though the cash often stayed in Alameda’s accounts and was not kept separate from Alameda’s assets. FTX later opened its own customer bank accounts, but some customer deposits continued going to Alameda.

That makes reconciliation central to the story. The screen showed what the exchange credited to the customer. The bank account showed who actually held the cash. Someone reconciling those records could see a relationship that the customer’s account display concealed. The order also found that FTX and Alameda regularly transferred assets between themselves without proper documentation or effective tracking.

Related-Party Transfers Paid Alameda’s Debts

The consent order found that Alameda used customer assets to pay its own debts when lenders called loans. Alameda lacked enough liquid assets to meet the demands and increased its use of customer deposits. Its existing access through FTX enabled the withdrawals.

The criminal case against FTX’s founder also showed where customer funds went. According to the Justice Department’s account of the trial evidence and public filings, the founder used them for investments, political contributions, real estate and repayment of Alameda’s loans. He also directed false financial statements for lenders, inflated revenue and profit figures for investors, and backdated contracts and other documents to conceal the misuse.

Those documents give an insider more than a transfer to recognize. A lender’s financial statement, an investor presentation and an earlier version of a contract can show how the business described the same money to different audiences. We connect that description to the assets the customer entrusted to the exchange.

The Ledger Changed Who Appeared to Owe the Money

The FTX consent order found that executives concealed approximately $8 billion in Alameda’s dollar liabilities by reallocating them to another customer account. That account began as an Alameda sub-account, then became associated with an account that was not readily identifiable as Alameda’s. The system notes called it “ftx-fiat-old.”

The reassignment made Alameda’s negative balance harder to see on FTX’s ledgers. The destination account also carried the withdrawal exception and exemption from liquidation. Changing the account association obscured the debt while preserving the access that helped create it. For someone who knows the account structure, the reassignment and the permission belong in the same account of what happened.

What Executives Knew and Customers Were Told

The consent order contrasts what FTX’s leadership knew with what it told customers. Internally, executives acknowledged that customer assets were unavailable because they had been misappropriated, while public statements continued to describe a liquidity problem and say customer deposits were safe. That difference matters to the finance or communications employee who saw both accounts.

The order also recounts a staff meeting where Alameda’s chief executive acknowledged the use of customer assets to pay its debts and senior FTX executives’ knowledge. She explained that the exchange’s structure let Alameda access those assets without FTX’s approval. An internal account of the decision can connect the permission to the people who understood exactly what it allowed.

Cryptsy’s Alleged Theft and a Separately Reported Exchange Hack

Internal account records can connect allegedly stolen crypto assets to whoever controlled the wallets. The criminal charges against Cryptsy’s founder describe alleged personal theft alongside a separate hack account given to employees.

According to the Justice Department’s announcement of the indictment against Cryptsy’s founder, he allegedly used his control over the exchange’s wallets to steal more than $1 million in customer funds between May 2013 and May 2015. The indictment alleged that he moved the funds into a personal cryptocurrency wallet and then his personal bank account, without disclosing the theft to customers.

The same announcement says he told employees in July 2014 that an unidentified hacker had stolen more than $5 million in cryptocurrency. According to that account of the charges, he continued operating and soliciting customers for six months without telling customers about the reported security breach. Employees heard about an outside hacker while the indictment described their boss moving customer money into his own accounts.

The indictment also alleged that, after learning Cryptsy was in receivership, the founder remotely entered its servers, took its customer database and destroyed the database to conceal his activity. That allegation puts the exchange’s internal records at the center of the case. The wallet transfers, the explanation employees heard and the customer records each carry a different part of the story.

What Proof Do You Need as a Whistleblower?

Useful proof connects the custody promise, the permission to move assets, the customer account and the destination of the money. A public blockchain transaction can show a transfer. Exchange records connect that movement to the customer credited internally, the business controlling the wallet and the staff who knew what the transaction meant.

The custody model explains why. The Financial Crimes Enforcement Network’s guidance on virtual-currency business models describes a hosted wallet provider as receiving, storing and transmitting value for account holders. The customer’s value may be represented by an entry in the provider’s accounts, while the provider has independent control over it. Internal ledger transfers need not appear individually on the public blockchain.

For an insider, the most useful records answer connected questions:

• Customer terms and public statements: What did the exchange promise about ownership, custody and use of the assets?
• Code and account permissions: Which accounts could withdraw with a negative balance, avoid liquidation or reach customer wallets?
• Ledgers and reconciliations: Which customer received the credit, which account held the assets and where did a related party’s liability appear?
• Transfers and financial statements: Who received the value, and how did the business describe its use to customers, lenders and investors?
• Versions and internal communications: When did the permission, account association or explanation change, and who directed or knew about it?

These are connections we examine with you, including who held the keys and whose approval actually moved the assets. The code change in FTX’s criminal case, the account reassignment in the consent order and the alleged destruction of Cryptsy’s database show why the internal history matters. A custody employee’s knowledge can explain a transfer that a public wallet address alone leaves unexplained.

Where a Crypto Whistleblower Fits

The CFTC whistleblower program offers awards of 10% to 30% of collected monetary sanctions in qualifying actions where sanctions exceed $1 million. In a separate digital-asset enforcement action involving improper trading, the agency announced an award of more than $1 million to a whistleblower whose information caused the investigation to open. An insider’s knowledge can give investigators the starting point they need.

Commodity fraud, securities fraud and money-laundering violations have distinct enforcement and whistleblower programs. We work through those distinctions with you to connect what you know to the right program and the whistleblower lawyers with the expertise your case needs.

We also assess whether government money is involved and a separate False Claims Act case fits the facts. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers.

When You Know Who Had Access

If you saw a withdrawal exception, a customer balance shifted to another account or a financial statement that hid where customer assets went, speak with our whistleblower experts about the access you saw. We work beside you to connect the technical decision to the money and build the strongest case your information supports. We bring in crypto fraud whistleblower lawyers who understand exchange custody and stay with you through the process.