Report Highlights FTX’s Odd Practices Around Security and Financial Controls

FTX-affiliated Alameda Research was “hilariously beyond any threshold” of auditors, Sam Bankman-Fried reportedly said.

That comment in an internal email before the bankruptcy filings of the two companies was brought to light in a report by FTX’s new management released Sunday (April 9), The Wall Street Journal (WSJ) reported Monday (April 10).

The report highlights a number of oddities that would have made both Alameda Research and FTX a difficult case for an audit, according to the WSJ.

For example, Bankman-Fried said it wasn’t unusual for executives to come across millions of dollars’ worth of assets that had been forgotten. “Such is life,” he said, per the report.

In another example, the Slack messaging system was used to submit expenses and invoices, and emojis were used in turn to approve them, the report said.

Only informal records — if any records at all — were made around transfers that amounted to tens of millions of dollars, according to the report.

There were oddities around security at the firms as well. Private keys allowing for the movement of crypto assets lacked proper descriptors and were sometimes left in unencrypted files on a server; crypto assets were left in hot wallets that were connected to the internet; and crypto transactions could be made without the precaution of involving multiple people, the report said.

In addition, when using tools like Google accounts and password managers, FTX and Alameda Research failed to require staffers to use multifactor authentication, per the report.

As PYMNTS reported Monday, a report found that financial oversight at FTX under Bankman-Fried was something of a joke and that the company’s failure was caused by a lack of proper controls.

The lack of internal controls and oversight at the failed enterprise would almost be comical if it weren’t so disastrous for the company’s millions of customers who lost billions of dollars, another PYMNTS report noted Monday.

“Key executive functions, including those of chief financial officer, chief risk officer, global controller and chief internal auditor, were missing at some or all critical entities,” the report said. “Nor did the FTX Group have any dedicated financial risk, audit or treasury departments.”