FTX: How Missing Controls Brought Down a Crypto Exchange

Why the collapse of a crypto exchange matters to small businesses too

In 2022, FTX was one of the largest trading venues for crypto-assets. Celebrities promoted the exchange, major investors had reportedly put in almost two billion US dollars, and its founder appeared in Washington as an advocate of stricter rules. In November 2022, the company became insolvent within a few days.

This article asks: How could missing controls bring down a crypto exchange of this size, and what follows for a business that has other people's money or crypto-assets held in custody? To answer it, we first recount the documented sequence, then explain the bank-run model, weigh two readings, and derive a test for your own business. This article is not investment advice.

What happened: the documented facts

Two companies are at the center. FTX was an exchange on which customers bought, sold, and held crypto-assets. Alameda Research was a trading firm that traded with its own money. Both were founded and controlled by Sam Bankman-Fried. An exchange that also serves its own founder's trading firm faces an obvious conflict of interest.

1. November 2, 2022: the report

   The trade outlet CoinDesk reports that a large part of Alameda's balance sheet consists of FTT, a token issued by FTX itself. The trading firm's value thus depends on an asset created by the exchange.

2. November 6, 2022: the trigger

   The head of rival exchange Binance announces that he will sell holdings of FTT. Customers begin withdrawing balances from FTX. According to Bankman-Fried, around six billion dollars are withdrawn in 72 hours.

3. November 8 to 9, 2022: the failed rescue

   Binance announces a takeover and withdraws the offer the next day after reviewing the documents. FTX halts withdrawals.

4. November 11, 2022: bankruptcy

   FTX and around a hundred affiliated companies file for creditor protection in Delaware. Bankman-Fried resigns; John J. Ray III becomes the new CEO.

5. 2023 to 2026: verdict and appeal

   In November 2023, a jury in New York finds Bankman-Fried guilty on seven counts, including fraud against customers and lenders. In March 2024, he is sentenced to 25 years in prison and forfeiture of eleven billion dollars. In June 2026, the appeals court upholds the verdict and sentence. Three former executives had previously pleaded guilty and testified as witnesses.

In his declarations to the bankruptcy court, Ray described the company bluntly. Management had effectively rested with three young people with no experience in risk management; many companies had never held a board meeting; independent experts in finance, accounting, and IT security were missing (Walker and Perkins 2023). His sentence was widely quoted: 'Never in my career have I seen such a complete failure of corporate controls.'

The thinking model: the bank run

In 1983, the economists Douglas Diamond and Philip Dybvig described why banks are vulnerable to a run. A bank lends part of its deposits long term. This works as long as not all depositors want their money at the same time. But as soon as enough customers fear that others will withdraw, it is rational for everyone to withdraw quickly themselves. The fear then fulfills itself. Stablecoins and MiCA uses the same model to explain the central risk of stablecoins.

For an exchange, this risk should not actually exist. An exchange does not lend customer deposits; it holds them. If all customers withdraw at once, everything must be there. At FTX, it was not. The prosecution and witnesses described in court that customer funds had flowed to Alameda and been used there for trades, investments, and expenses. The run did not cause the gap; it made it visible.

An everyday analogy: a theater cloakroom returns every guest's coat, even if everyone wants to leave at once. It takes time, but every coat is there. If the cloakroom lent out coats during the performance, chaos would break out at the final applause. The problem would not be the rush but the lending.

Whoever holds other people's money should never have to fear a run. If he fears one, the money is no longer all there.

What creditors get back and what that means

The case has a surprising twist. The bankruptcy administrators realized holdings and crypto-assets whose value had risen sharply after 2022. Since 2025, creditors have received payouts. By March 2026, US customers had reportedly reached 100 percent and smaller claims 120 percent of their claims. By mid-2026, around ten to eleven billion dollars had been paid out.

The rate is misleading, however. Claims were fixed in dollars at November 2022 prices, when crypto-assets stood very low. Anyone who held bitcoin on the exchange at the time receives dollars that, at later prices, are worth only a fraction of their bitcoin. One analysis found that a rate of 143 percent in dollars equaled about 22 percent in bitcoin terms. Add to that four years without access to one's own assets.

This yields a sober lesson: that money eventually came back was luck in the liquidation, not a merit of the custody. A business that holds crypto-assets should never depend on that. Bitcoin on the balance sheet describes which questions it must clarify beforehand.

Two readings: one person's fraud or a gap in the system?

Walker and Perkins (2023) stress the second side. The main company was registered in Antigua and Barbuda, where a director does not even have to be a natural person. Despite the inexperience of management, large institutional investors had no representative on the board. Alade (2025) goes further: at fintech firms, conventional corporate governance reaches its limits because many decisions are embedded in software and automated processes. Fintechs and supervision discusses this view in detail.

I consider both readings correct, with a clear weighting for the reader's business. The deception is a matter of individual responsibility and has been established in court. That it was possible was because nobody checked the simplest question: is the customers' money there, held separately? The Theranos case shows the same pattern of trust in prominence instead of proof.

What has changed since then

In the EU, the Markets in Crypto-Assets Regulation, MiCA for short, has applied in full since December 30, 2024. Crypto service providers need a license; the longest transitional periods ended on July 1, 2026. Custodians must hold client assets separately from their own holdings and keep a register of their clients' positions. The very duty on which FTX would have failed is thus expressly regulated.

The limit is obvious. Rules do not prevent deception; they make it harder and easier to prove. They do not apply to providers outside the EU. Anyone who holds crypto-assets through a provider must therefore still check where it is licensed.

The segregation test for your business

A small business also holds other people's money or has its own held by others: customer down payments, deposits, balances with payment providers, crypto-assets with a custodian. From the case I derive the segregation test, three questions for every place where money lies that should not be freely available.

1. Is it separate?

   Check whether other people's money sits in its own account or is mixed with operating funds. For crypto-assets: whether the custodian is licensed under MiCA and holds client assets separately. Holding crypto-assets in a business discusses what to watch for.

2. Can I check it myself?

   Evidence produced only by the custodian is a claim. Secure your own read access or a confirmation from a body the custodian does not control.

3. What happens if everyone wants it at once?

   Work out what happens if all customers demand their down payments back or you have to withdraw all balances in one day. If the answer is uncomfortable, the money is not really separate.

The test also applies to your own organization. Where one person alone can decide on, move, and book money, the second line of control is missing. Corporate governance for small businesses describes how a small business can change this with little effort. If you are considering accepting payments in crypto-assets, Crypto as a means of payment sets out the trade-offs.

Conclusion: trust only holds what is held separately

To the guiding question: FTX did not fall because customers suddenly withdrew, but because the customers' money was not all there when they did. This was possible because controls were almost entirely absent: no functioning boards, no independent experts, no separation of customer money and proprietary trading, domicile in countries with weak supervision. The bank-run model explains why the gap became insolvency in nine days. A court has established individual responsibility.

For a business, the lesson is simple: other people's money must be held separately, and whoever has it held needs proof that the custodian does not produce itself.

• List all places where other people's or committed money of the business is held.
• For each place, check whether the money is held separately and can be viewed yourself.
• For crypto service providers, look up the MiCA license and the segregation of client assets.
• Decide who approves payments and who executes them, and ensure it is not the same person.