# FTX Collapse & Aftermath

### FTX Entity Dashboard:

During the early stage of the FTX crisis, we quickly formed the FTX exchange entity dashboard by putting multiple related addresses into one entity.

<figure><img src="/files/K0QqbSv6gOSy8lqkMnmn" alt=""><figcaption></figcaption></figure>

This shows us how many assets FTX still holds and the estimated outflow value.

<figure><img src="/files/o1IFxXsFz0dYIAcmW8vp" alt=""><figcaption></figcaption></figure>

This also helps many users get their assets out by withdrawing the high-balance tokens shown in our entity dashboard.

<figure><img src="/files/OwkM7RqEdhBnIZerc2y1" alt=""><figcaption></figcaption></figure>

## Money Flow

#### Case 1

During the period when FTX was experiencing a capital run, we want to know who was aiding FTX and providing it with liquidity, so we made the money flow below:

These two money flows represent FTX’s capital inflow on November 7th and 8th respectively. In the chart, from left to right are the source of funds, deposit address, and FTX hot wallet.

The Moneyflow Feature can clearly show the source of each fund. By clicking each connecting line, you can also see specific transaction information, including token name, time, value, etc.

<figure><img src="/files/MSujRkHA3a5VKhQXHPH1" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/VpGos0o6T2zbC6w2ghn4" alt=""><figcaption></figcaption></figure>

From the source of fund on the left (Upper Picture 1 & 2), we can see that most of them are other exchanges and Alameda, and there is no FTX cold wallet.

#### Case 2

When FTX stopped withdrawal, there were more than 600M+ assets left on the FTX exchange, but on Nov 11/12th, all assets got transferred out and went to different sources.

We used the **Money Flow** **Tool** to quickly locate the fund.

By inputting the FTX exchange addresses and keep expanding the next level's addresses, we find the clear flow goes in two different directions:

1. $300M goes to a 2-3 multi-sig. (which later proves to be Bahama Authority)

   <figure><img src="/files/m8NR2YadcgZJgZLS4XPy" alt=""><figcaption></figcaption></figure>
2. $300M goes to an EOA address and the address exchanged half of the assets for $ETH.

<figure><img src="/files/IIpFwbT5dbXzorpKtbvg" alt=""><figcaption></figcaption></figure>

By using the **Money Flow Tool**,  we quickly located the funds and were able to collect the addresses for later monitoring. This work helps us to quickly respond to those later actions.

## Alerts

#### Case 1

During the FTX incident, we were the first to find out that FTX withdrawals were halted and that FTX withdrawals reopen for the Bahamas.&#x20;

This is because we set the alerts for the transfer out/in of FTX exchange addresses.&#x20;

Take withdrawal to reopen as an example, when it starts, we will receive alerts on our supported platform (Telegram, Discord, etc) that display the transaction details.

<figure><img src="/files/hKBzLdoY1gu3qtJMnHqV" alt=""><figcaption></figcaption></figure>

Being the first to know this by using Scopescan Alerts helps our users to grasp the opportunity, including the short-term $FTT price change.

#### Case 2

After part of FTX's assets were transferred to a hacker's address, we closely tracked the hacker's activities and set up an alert.

<figure><img src="/files/vSk8LK66kioE50qWZhnm" alt=""><figcaption></figcaption></figure>

For example, on November 22, the hacker transferred ETH to 12 addresses, and the on-chain activities can also be well displayed with Moneyflow.

<figure><img src="/files/GUZcu4Baj5Iz1nTymMtR" alt=""><figcaption></figcaption></figure>

By paying attention to hacker activities, such as dumping tokens, with the help of alerts, you can avoid losses and even find arbitrage opportunities. For determining the hacker's identity, every transaction by the hacker may be a clue, so timely tracking is important for the investigation agency.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.scopescan.ai/use-cases/ftx-collapse-and-aftermath.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.