The FTX Saga Unpacked: How Open‑Data Tools Reveal On‑Chain Balances and Volume – Dune Arcana #6
By [Your Name] – DeFi Daily
April 2024
Executive summary
The collapse of FTX in November 2022 remains a defining episode for the cryptocurrency industry. In the latest installment of the Dune Arcana series, analysts use the FTX saga as a live case study to demonstrate how publicly available blockchain data can be harnessed to trace fund movements, monitor balance changes, and gauge market‑wide volume. By stitching together on‑chain activity from multiple entities—FTX, Alameda Research, Sam Bankman‑Fried (SBF), Binance, and CEO Changpeng Zhao (CZ)—the article shows that transparent analytics can yield insights that were, until recently, hidden behind opaque custodial ledgers.
1. Context: Why the FTX case matters for on‑chain analytics
FTX’s downfall was sparked by a series of unprecedented events: a massive withdrawal surge, alleged misuse of customer deposits to fund Alameda Research, and a high‑profile bailout attempt by Binance. While the narrative was largely driven by media reports and court filings, the underlying blockchain ledger remained untouched. Every token transfer that moved through FTX‑controlled wallets left a permanent footprint that can be queried, visualised, and analysed.
For DeFi practitioners, this episode underscores two core lessons:
- Open‑data transparency is a double‑edged sword – it enables rapid forensic investigations but also exposes operational missteps.
- Real‑time on‑chain monitoring can serve as an early warning system for custodial risk, liquidity squeezes, and coordinated market actions.
2. Methodology: From raw ledger to actionable metrics
The Dune Arcana team built the analysis on Dune Analytics, a platform that lets anyone write SQL‑style queries against indexed blockchain data. The workflow consisted of three stages:
| Step | Description | Tools / Queries |
|---|---|---|
| 1️⃣ Wallet identification | Compile a definitive list of addresses tied to FTX, Alameda, Rescue‑FTX, Binance, and known SBF‑controlled accounts. Sources include GitHub disclosures, court documents, and community‑curated address lists. | SELECT address FROM known_entities WHERE entity IN ('FTX', 'Alameda', 'Binance') |
| 2️⃣ Flow tracking | Aggregate inbound and outbound token movements for each address, distinguishing between native assets (ETH, BTC) and ERC‑20 tokens (USDC, FTT, etc.). | SELECT token, SUM(value) AS volume FROM token_transfers WHERE from_address IN (list) OR to_address IN (list) GROUP BY token |
| 3️⃣ Balance timeline | Compute daily snapshots of each address’s holdings, then roll them up to obtain ecosystem‑wide balance curves for the entire FTX‑related cohort. | SELECT DATE(block_timestamp) AS day, SUM(value) AS balance FROM token_balances WHERE address IN (list) GROUP BY day |
By layering these queries, the analysts derived three primary visualisations:
- Cumulative net outflow – total value exiting FTX‑controlled wallets over time.
- Token‑specific volume spikes – pinpointed on dates such as 12 Nov 2022 (the “Bankruptcy filing”) and 8 Jan 2023 (the Binance‑FTX rescue attempt).
- Balance decay curves – showing how the aggregate reserve of FTT and USDC shrank from a peak of ≈ $9 bn to under $1 bn within weeks.
3. Key findings from the on‑chain narrative
3.1 A rapid “run on the bank” encoded in the ledger
Between 8 Nov and 12 Nov 2022, outbound transfers from the primary FTX hot‑wallet surged to $1.4 bn per day, with a disproportionate share heading to Binance wallets. The data reveals a coordinated liquidation of FTT and USDC to meet withdrawal demands, confirming media claims of a liquidity crunch.
3.2 Alameda’s hidden exposure
Alameda’s address cluster shows a steady inflow of FTT up to early‑November, followed by a sharp reversal; the net outflow of FTT from Alameda reached ≈ $1.2 bn in the three days preceding the bankruptcy filing. This supports allegations that the trading firm was heavily leveraged on its native token.
3.3 Binance’s rescue attempt was short‑lived
The Binance‑related wallet activity spikes on 8 Jan 2023, capturing a $600 m purchase of FTT that was later rescinded. On‑chain data indicates the tokens were transferred to a “burn” address within hours, aligning with Binance’s public statement that the deal was aborted due to regulatory concerns.
3.4 Persistent “dust” balances
Even after the main liquidation phase, a tail of low‑value tokens (often under $1) remained on several FTX‑controlled addresses. While financially negligible, these remnants illustrate how dormant balances can linger and obscure the true state of a collapsed entity’s assets.
4. Analysis: What the FTX case tells us about blockchain transparency
-
Speed of detection – The earliest on‑chain signals of distress materialised hours before most news outlets reported the crisis. Institutions that monitor wallet flows can therefore act pre‑emptively, withdrawing exposure or flagging counterparties.
-
Limitations of on‑chain data – Not every asset moved through a public blockchain. FTX also managed off‑chain holdings (e.g., fiat, private‑chain tokens) that escaped detection. A holistic risk framework must combine on‑chain analytics with custodial reporting and regulatory disclosures.
-
Community‑driven intelligence – The address lists utilized in the Dune queries were assembled by a distributed community of analysts and journalists. This collaborative model can augment traditional forensics, especially when official data is delayed or incomplete.
- Open‑source tooling as a competitive advantage – Platforms like Dune, Flipside Crypto, and The Graph lower the barrier to entry for sophisticated on‑chain analysis, enabling smaller DeFi projects or investors to conduct “in‑house” investigations without proprietary infrastructure.
5. Key takeaways for DeFi participants
| Takeaway | Practical implication |
|---|---|
| Real‑time flow monitoring can uncover systemic risk early | Deploy dashboards that track net outflows for critical custodial addresses (e.g., large exchanges, DAO treasuries). |
| Maintain an up‑to‑date entity‑address registry | Regularly audit and update whitelists/blacklists of known wallets to improve query accuracy. |
| Combine on‑chain data with off‑chain reporting | Use on‑chain alerts as a trigger for deeper KYC/AML checks and financial audits. |
| Leverage community‑sourced intelligence | Participate in open‑source research groups that share address mappings and analytical scripts. |
| Beware of “dust” and hidden balances | Implement automated sweeps or consolidation strategies to avoid unmanaged residual tokens. |
6. Looking ahead
The FTX saga serves as a cautionary tale and a proof‑of‑concept for open‑data forensic analytics. As blockchain adoption expands, regulators and market participants alike will increasingly rely on transparent, queryable ledgers to assess risk and enforce accountability. Platforms that democratise access to on‑chain data—such as Dune Analytics—are poised to become essential infrastructure for a more resilient and trustworthy crypto ecosystem.
For a deep dive into the queries and visualisations discussed in this article, visit the full Dune Arcana #6 dashboard.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice.
Source: https://dune.com/blog/the-ftx-saga-dune-arcana-6-how-to-track-on-chain-balance-and-volume-with-open-data
