Alameda's On-Ramp

Tether has been one of the major mysteries of the cryptosphere for a long time. It has never been audited, and has been described as being "practically quilted out of red flags". Matt Levine says "I feel like eventually Tether is going to be an incredibly interesting story, but I still don’t know what it is." He was commenting on Emily Nicolle's Bankman-Fried Trial Renews Conjecture About Alameda’s $40 Billion Tether Stablecoin Pile by Emily Nicolle. It includes a lot of interesting information, starting with this:

Alameda was Tether’s largest non-exchange customer between 2020 and 2022, with blockchain data showing it received almost $40 billion in transfers of its stablecoin USDT directly from the company — equal to roughly 20% of all USDT tokens ever issued.

Below the fold, I discuss the questions Nicolle raises, and go on to ask one she doesn't

The obvious question is:

The vast amount has raised questions about where Alameda got the money to fund the issuance of the stablecoin, which is typically used as a dollar proxy and is the world’s most traded cryptocurrency. That even led to speculation Alameda might have used other means to help fund the purchases, similar to its bets on startups or dealings with lenders.

By "other means" Nicolle means using FTX's FTT token. But, if you can believe Tether, that isn't what happened:

Tether’s incoming chief executive Paolo Ardoino appeared to clear up the mystery in a social media post this month, reiterating an earlier statement that the hedge fund wired dollars to Tether in exchange for the cryptocurrency.

An important part of the story is that most people and institutions can't buy USDT from, or sell USDT to, Tether directly. They have to go via one of the small number of institutions that are Tether customers. And those customers can only buy or sell in large amounts. Alameda was one of these customers. Nicolle quotes Jonathan Reiter:

“This was one major on-ramp, maybe the major on-ramp” for traders seeking access to USDT, said Jonathan Reiter, CEO of blockchain analytics firm ChainArgos. “It is certainly peculiar that FTX, which is now alleged to have run an essentially fraudulent exchange, still somehow managed to intermediate tens of billions in one-way flow from USD into USDT.”

My oversimplified mental model of stablecoins like USDT is that they are the chips in the casino. If you want to play the tables, you need to hand dollars to the cashier and get chips in return, because the tables only accept chips. The cashiers in the cryptocurrency casino need accounts at banks, so they can receive dollars or other fiat, and accounts at Tether, so they can receive USDT. Since the early days of Tether, it has been increasingly difficult for cryptocurrency traders and exchanges to maintain accounts at banks. For example, in this interview of Charles Yang by John Riggins, Yang (head trader of Genesis Block based in Hong Kong) says:

bank acccounts are the absolute most valuable thing — you have to set up a bunch of different companies, a lot of different bank accounts just to facilitate trades that aren't that big, maybe $50K. The moment you tell them this is for a USDT trade, you're basically asking them to shut your bank account down.

Alameda, run by ex-Wall Street whiz-kid US citizens, had the savvy and credentials to have bank accounts through which billions of dollars could be moved:

Alameda received around $39.6 billion in USDT tokens from Tether’s treasury wallet, according to on-chain data tracking its wallets, as labeled by the Arkham Intelligence platform.

Meanwhile wallets connected to FTX sent $3.9 billion in USDT tokens back to Tether, all during the crash of TerraUSD and Luna in May 2022 — meaning that Alameda largely transferred the tokens it received to other entities, rather than cashing it out for dollars with Tether directly. It’s worth noting that this may not record all of FTX or Alameda’s redeemed tokens due to the way Tether swaps its coins between different blockchains, according to Coinbase’s Conor Grogan, who updated Alameda’s USDT total after most of its transactions were first reported by Protos in 2021.

Presumably, Alameda received dollars via their accounts at US banks such as the late lamented Signature and Silvergate, aggregated them into orders big enough for Tether, then:

To mint or redeem USDT, FTX would transfer funds via its own accounts at Tether’s Bahamas-based bank Deltec Bank or a US-based correspondent bank, Bankman-Fried said in a series of social media posts in 2021. A popular solution utilized by Tether and other crypto firms were banking networks established by Signature Bank and Silvergate Bank, both of which collapsed earlier this year.

The mismatch between the minting and redeeming is why Reiter talks about a "one-way flow from USD into USDT". It seems clear that Alameda was exploiting its access to both the banking system and Tether to facilitate this flow. How big a player were they in this flow?:

A rough estimate using transactional data for USDT’s main two networks — Ethereum and Tron, which support about 98% of USDT’s current circulation — shows Tether has issued about $190 billion in USDT between its inception and Oct. 20, according to analysis by ChainArgos.

Conversely, Tether has redeemed about $108 billion in its lifetime. The difference is about $82 billion, compared with around $84 billion in circulation. The discrepancy can be attributed to the amount of USDT trading on other blockchains, according to ChainArgos.

Alameda bought $40B of USDT out of a total mint of $190B and sold $4B out of total burn of $108B. They were ~21% of the on-ramp but only 4% of the off-ramp.

Nicolle again quotes Reiter:

“This does not really look like a market-maker or trading firm as those terms are normally used. It looks more like a money changer,” said Reiter.

Inflows and outflows from Alameda’s main wallet each month were almost equal, Reiter said, indicating that the main purpose for the mints was most likely to facilitate USDT purchases on behalf of FTX and its customers. This is supported by Bankman-Fried’s statements that FTX would transfer funds via bank accounts to Tether, in addition to evidence submitted to his trial which alleged that FTX often relied on Alameda’s bank accounts for exchange purposes.

“These guys were running a one-way USD to USDT bureau de change,” said Reiter, adding that any USDT that Alameda actually held on to was never in large size relative to its minting activity.

This explains how a significant part of the $190B Tether minted was funded. But it begs the question of where the $104B redeemed went that didn't go to Alameda? Who were the Tether customers who made the redemptions and what did they do with the dollars?

Source

On the Chain Argos blog, Patrick Tan's A Tale of Tether on TRON Before and After the Russian Invasion of Ukraine suggests one answer. Tan notes that:

Although most attention is focused on the use of Tether on the Ethereum blockchain, the reality is the bulk of transactions occur on TRON for a simple reason — low or zero transaction fees.
...
Using data from ChainArgos, 50 so-called “whale wallets” for USDT on the TRON blockchain were analyzed in the weeks leading up to, and following, the Russian invasion of Ukraine.

From the chart above, it’s clear that the 50 biggest wallets that transact in Tether on TRON saw a larger cluster of activity just before and after the Russian invasion of Ukraine in February 2022.

None of the wallets (as far as has been identified) are wallets belonging to cryptocurrency exchanges.

But:

one of those wallet addresses:

TCTrwC2rxGFRS74XihgdMkp5mLYGezdrDL

(the “Alameda Wallet”) also happens to be the wallet used by Alameda Research (yes that one) to deposit funds into cryptocurrency exchange FTX.com.

Even as the trial of FTX.com founder Sam Bankman-Fried proceeds in earnest, the Alameda Wallet saw a massive $300 mm in Tether flow into it, occurring just days before the Russian invasion.

And then:

Of particular note was this wallet address:

TYZseM53iSPB75aN1V5N762GgzAjBp7PcX

which sent a whopping $194 mm USDT in just two weeks around the time of the invasion.

And a quick Google search of the address reveals Telegram (the messaging service) posts by “The Ghost of New Russia” containing this wallet address that appeared to be raising funds for Russia’s invasion.

On further analysis, this wallet, and others with large USDT transactions in the run-up to the Russian invasion are part of a massive Russian-Kazakh pyramid scheme that had already been blacklisted by the Russian central bank in 2022.

After the USDT is collected into:

TYZseM53iSPB75aN1V5N762GgzAjBp7PcX

it’s then withdrawn into a collection of wallets, but with two in particularly large sizes:

1. TXxU8LJ9wwQxUdg1YNP7LPz4YSXB5guhc5
2. TCtVdT6XSoWcQifTHbBzFcuaUDX9oo8Yr5

Then there’s a few withdrawals for less than $2 mm, almost as if someone is taking their “commission” or “fees” for facilitating the transactions.

What happens next is relatively predictable, from these withdrawal wallets, the USDT was sent to cryptocurrency exchange Binance, probably for the final cashing out into fiat currency.

That Binance provided an off-ramp isn't unexpected. What was unexpected was that the spike in off-ramping started two weeks before the invasion. The Russians maintained good enough operational secrecy that Ukraine was suprised and the troops thought they were on exercise. Knowing two weeks ahead that Ukraine would be invaded means the off-rampers were very close to Putin. Tan speculates that the funds were destined for the Wagner Group:

One possible explanation is Russia’s heavy use of the Wagner Group — mercenaries closely affiliated with the Kremlin, but disavowed when convenient.

And as is known, mercenaries, whether at the Battle of Waterloo or the Donbas, need to be paid, whether in gold, or a hard currency like the dollar, failing which Tether will do.

This explanation becomes all the more plausible because the shadowy Wagner Group has been operating in the Donbas since 2014.

So if Russia wanted to wage an all-out invasion of Ukraine, and the Wagner Group needed to recruit mercenaries in a hurry without an audit trail linked to the Kremlin, what better way than using stablecoins such as Tether?

And if a Wagner Group mercenary wanted to ensure he’d get paid no matter what, which would he prefer, the ruble against a backdrop of soon-to-be sanctioned Russian banks, or Tether on TRON?

It is very plausible that the uptick in USDT activity was related to the invasion, but I am more skeptical about the far end of the off-ramp being the Wagner Group. As I understand it, the Russians did not plan an "all-out invasion of Ukraine"; they expected their armored thrusts and airborne landings to swiftly capture Kyiv and its government, which would be replaced by a puppet administration supported by the mass of the Ukrainian population. Wikipedia suggests that Wagner's initial involvement was limited to two of three attempts to assassinate Zelenskyy.

Doubtless, Yevgeny Prigozhin and Wagner's leadership would have known of the invasion plans, probably much more than two weeks ahead, and seen it as prudent to accumulate fiat. But I doubt that this fiat was intended for recruiting additional mercenaries, which wouldn't have been needed had the invasion plans worked out.

Nevertheless, I agree with Tan when he argues:

that’s why it’s so important to monitor stablecoin flows — because they can provide an orthogonal data point that most fund and risk managers may miss.

Whether as an indicator of leverage or risk appetite, or as a precursor to a potentially economically destabilizing conflict, stablecoin flows are becoming an increasingly important metric to monitor.