Four years ago, on 2 November 2022, CoinDesk published a leaked balance sheet from Alameda Research. Nine days later, FTX filed for bankruptcy. This is the first part of our FTX series, a day-by-day account of 2 to 12 November 2022. Part of Know the Scam by SimpleSwap.
In June 2026, a three-judge panel of the US Court of Appeals for the Second Circuit affirmed Sam Bankman-Fried’s conviction on seven counts and his 25-year sentence. The Second Circuit mandate issued on 4 August ended proceedings in that court. Bankman-Fried filed a petition for Supreme Court review on 10 September 2026; it remained pending as of 3 November 2026. It began its fifth distribution, roughly $900 million, bringing the total returned to creditors since 2025 to nearly $10 billion.
Those numbers make FTX look like a story that ended well enough. It did not end the way customers expected. Under the Chapter 11 process, the court values customer digital-asset claims in US dollars as of the 11 November 2022 petition date, using court-approved conversion rates. Recoveries therefore depend on the dollarized claim rather than simply returning the same quantity of each crypto asset shown in the account.
That is the part of FTX worth re-reading in 2026. The fraud was specific to FTX, Alameda and related actors; the broader structural lesson is about counterparty risk when users leave assets on a custodial platform. Platform balances are still everywhere.
2 November: a balance sheet, not a hack
Nothing was breached on 2 November. CoinDesk reporter Ian Allison published details of a leaked Alameda balance sheet dated 30 June 2022. Bankman-Fried founded Alameda as a trading firm and continued to control it after stepping down as CEO in 2021, while also running FTX. On paper it looked large: $14.6 billion in assets against about $8 billion in liabilities, $7.4 billion of which were loans.
The key detail sat at the top of the asset column. The largest single entry was $3.66 billion of “unlocked FTT,” with another $2.16 billion listed as “FTT collateral.” FTT was FTX’s own exchange token. The trading firm next door to the exchange was valued largely in a coin the exchange had issued, and that coin was worth only what buyers would pay for it on a calm day.
3 to 5 November: the market reads the document
FTX said little publicly during 3 to 5 November. On-chain observers were already watching flows, but the best-documented run came after Binance’s 6 November announcement. A later Chicago Fed analysis estimated about $7.81 billion of withdrawals from FTX between 6 and 11 November, illustrating how quickly the liquidity crisis accelerated once confidence broke.
6 November: Binance sells, Alameda names a price
On Sunday, Binance CEO Changpeng Zhao said Binance would liquidate its remaining FTT, part of the roughly $2.1 billion in BUSD and FTT it received when it exited FTX equity in 2021, citing recent revelations. Alameda CEO Caroline Ellison replied that the leaked sheet covered only a subset of the firm’s entities and left out more than $10 billion in assets. Then she publicly offered to buy all of Binance’s FTT at $22.
Bitcoin Magazine’s analysts read the offer as a warning sign: a firm has little reason to defend a specific price unless it has borrowed against that price.
7 November: “FTX is fine”
Bankman-Fried posted that FTX was fine and its assets were fine. The post was later deleted. Customers were already pulling money: he later told staff the exchange had seen about $6 billion in net withdrawals over 72 hours.
A statement that assets are fine costs nothing to post. For anyone holding a balance on a platform, the only real proof is a withdrawal that goes through.
8 November: withdrawals stop
FTX.com effectively paused most customer withdrawals. The same day, Zhao announced that Binance had signed a non-binding letter of intent to acquire FTX.com, subject to due diligence, to help cover what he called a liquidity crunch. FTT fell sharply as the crisis intensified; the token ultimately collapsed from the mid-$20s to low single digits during the run.
9 November: Binance walks away
On 9 November, Binance withdrew from the proposed deal, citing corporate due diligence and reports concerning mishandled customer funds. That evening, Bankman-Fried told investors FTX faced a shortfall of up to $8 billion. Binance pulled out of the deal, citing its review of FTX and reports of mishandled customer funds. That evening Bankman-Fried told investors FTX faced a shortfall of up to $8 billion.
10 November: an apology and a freeze
Bankman-Fried posted a long thread that opened with an apology and confirmed Alameda was winding down trading. The Securities Commission of the Bahamas, where FTX was based, froze the assets of FTX Digital Markets, the group’s licensed local subsidiary.
The freeze did not apply equally to every customer. FTX briefly reopened withdrawals for users it identified as Bahamian, while most customers remained locked out. The Securities Commission of The Bahamas later said it had not directed, authorized, or suggested preferential withdrawals for Bahamian clients and warned that such transactions could be treated as voidable preferences. A later bankruptcy investigation also described users exploiting the Bahamian exception through NFT trades.
11 November: Chapter 11
FTX Trading and Alameda Research filed for Chapter 11 in Delaware together with more than 130 affiliated entities. Bankman-Fried resigned as CEO, and restructuring specialist John J. Ray III took over. The day before the filing, FTX’s international exchange reportedly held about $900 million in liquid assets against $9 billion in liabilities.
11-12 November: unauthorized transfers after bankruptcy
Unauthorized transfers began on the evening of 11 November, hours after the Chapter 11 filing. Elliptic identified about $477 million in suspected stolen cryptoassets. FTX staff and, under Bahamian court orders, the Securities Commission of The Bahamas also made other movements from FTX-controlled wallets. FTX later confirmed that unauthorized access to certain assets had occurred.
Fourteen months later, US prosecutors charged three people over a SIM-swapping ring. The indictment alleges that on 11 November 2022 the group took over an FTX employee’s AT&T phone account with a fake ID, used the authentication codes it intercepted to reach the company’s accounts, and moved more than $400 million over the following hours. The indictment calls the victim “Victim Company-1”; a source familiar with the case confirmed to CNBC that it was FTX. We broke down how SIM swaps work in an earlier Know the Scam piece.
What the nine days still teach
A custodial platform balance isn't the same as controlling coins in your own wallet. Between 2 and 8 November, FTX customers learned that access to assets shown in an account depended on the exchange being able and willing to honor withdrawals. Under the bankruptcy process, digital-asset claims were then dollarized at petition-date values rather than treated as a right to receive the same quantity of each token back.
Reassurance is not evidence. The balance sheet was public on 2 November. The post saying assets were fine came five days later. Only one of the two described the company accurately.
Attackers can exploit periods of operational chaos. Prosecutors later alleged that a SIM-swap conspiracy enabled the theft of more than $400 million from FTX around the bankruptcy filing. The broader security lesson is narrower than the original wording: urgency and disrupted procedures can increase the chance that authentication and verification failures are missed.
Where SimpleSwap stands
SimpleSwap launched in 2018, four years before the FTX collapse, as a self-custodial swap aggregator, and self-custody has been the core of the product since day one. FTX didn't give us that idea. It showed, in public and at scale, what the alternative can cost.
The model works like this. SimpleSwap holds no long-term user balances. Crypto moves from one wallet you own to another, with the conversion routed through aggregated liquidity from 20+ CEX and DEX providers in a single time-bounded transaction.
That doesn't make a swap risk-free, and claiming so would repeat the mistake this article is about. You still verify the receiving address and pick the correct network, because confirmed blockchain transfers may be irreversible. A swap can also be paused for compliance review when transaction screening calls for a closer look. Most crypto-to-crypto swaps need no account. KYC may be required for transaction security and compliance, while fiat purchases through payment partners follow the partners’ verification requirements.
Registered users have one more tool for the other side of the transaction. Address Check, in the Customer Account, screens a wallet address through third-party services and returns a risk level and any connections it finds. It adds context about who you are sending to and may not identify every issue.
“The argument about who holds your money is won. The one about how you move it is still open. SimpleSwap has spent eight years on the second argument while keeping the first intact.”
Stefan Lauer, Head of Infrastructure, SimpleSwap, in the CryptoSlate self-custody guide
Our only official domain is simpleswap.io.
This article is for educational purposes only and is not financial or investment advice. SimpleSwap’s only official domain is simpleswap.io.
