How not to run a cryptocurrency exchange

At Liquid, the Japanese exchange recently acquired by FTX, warnings were ignored, violations were not reported, and employees were berated and cursed at, according to insiders.

The Takeaway:

From the outside, Japan's Liquid exchange looks like a crypto success story. Trading house FTX recently acquired it for an undisclosed price, estimated to be between $140 million and $200 million.
But former Liquid employees describe a chaotic workplace (even by crypto standards) with questionable security and compliance.
For example, sources say executives downplayed some information security breaches and failed to disclose others, failed to adequately address low-level insider thefts, and prematurely closed investigations into the $90 million hack last year.
Liquid bought its own QASH token to hold its price during part of the 2018 bear market, and double-counted trades when it reported its volumes, former employees said.
Management offered IOUs for Telegram's never-issued GRAM tokens, ignoring concerns from its internal compliance team, according to sources. Liquid lost millions on the offer.

The company's December 2018 Christmas party was unpleasant, to say the least, for employees of Japanese cryptocurrency exchange Liquid.

"From the outside

looking in,

Liquid looks like a crypto success story, albeit with some bumps along the way. It was one of the first exchanges to be licensed in Japan, which has some of the world's strictest regulations on cryptocurrencies.

Like many exchanges, Liquid has struggled with hacks, including a $90 million theft last August that forced the exchange to take out an emergency loan from crypto derivatives exchange powerhouse FTX. Led by billionaire Sam Bankman-Fried, FTX later agreed to buy Liquid, legally known as Quoine (pronounced "coin"), for an undisclosed price, with the deal closing on April 4 this year.

Over the past five weeks, CoinDesk interviewed more than a dozen former Liquid employees and others familiar with the exchange's inner workings. Almost all of them requested anonymity for fear of reprisals.

Overall, the interviews and internal documents CoinDesk has seen paint a picture of a chaotic workplace, even by the standards of a global crypto industry known for its charismatic personalities and loose corporate cultures.

Kayamori's management decisions and casual attitude toward information security may have led to security breaches, more than one of which was not adequately communicated to customers, according to four former employees. Employees were berated and cursed at, and their concerns about regulatory requirements, cybersecurity and business risks were ignored.

While some employees tried to advocate for users, management was known to ignore their efforts.

"There are forces of order and good trying to move things forward, but the existing culture has an immune system that seeks them out and destroys them," said one former employee.

CoinDesk emailed Kayamori for comment on whether Liquid has met regulators' expectations and if he has anything to say about former employees who have expressed dissatisfaction with the company's work culture and leadership. He did not respond.

Promising BeginningsIn2017

Japan was one of the most active places in the world for crypto. It was one of the first countries to regulate cryptocurrency exchanges, requiring them to register with the Japan Financial Services Agency (JFSA). Japan also introduced a legal definition of "virtual currency" in its Payment Services Act.

"There was huge retail interest, progressive regulators and huge potential for the country to become a true leader in this space," said Steve Lee, an investment director and head of Asia Pacific at BlockTower Capital.

Liquid was in pole position. The exchange, founded in 2014 under the name Quoine, presented itself as a company that plays by the rules. It was among the first companies to obtain a license and operated one of the largest exchanges in the country. In addition to Japan, the company had a presence in Singapore and had teams in the Philippines and Vietnam.

The company initially operated two exchanges, Quoinex, which facilitated trading between fiat currency and Bitcoin (BTC), and Qryptos, which only handled crypto-to-crypto trading. The company later merged the two and operated under the name Liquid.

Kayamori had a prestigious resume: he studied at Harvard Business School and the University of Tokyo and worked at SoftBank, the Japanese investment conglomerate. Co-founder Mario Gomez Lozada had worked at financial giants Merrill Lynch and Credit Suisse (CS). Kayamori handled business, while Lozada was responsible for technology and financial product development.

A former employee recalls working in a small office that consisted of one large room that could comfortably fit ten people and three meeting rooms, one of which became an extension of the office due to lack of space.

"Mike was a reasonable executive when times were good," said another former employee.

Kayamori's big visionKayamori

talked a

lot about lofty concepts like "financial inclusion" and "democratizing finance," the same former employee said. "He had a vague vision, but it was largely disconnected from reality."

Then, as now, the crypto market is an illiquid market compared to traditional stocks or bonds, meaning that a large order to buy or sell a coin is difficult to fill and can greatly affect market prices. Kayamori claimed Liquid could solve this problem through a pooling system he called "World Book."

There are hundreds of crypto exchanges around the world, each with its own order book, or list of offers to buy or sell a particular coin at a particular price. Kayamori wanted to aggregate orders from global exchanges into one order book. A sell offer for a token on the U.S. exchange Coinbase (COIN), for example, could be matched with a buy offer on Liquid if both listed the asset.

Investors believed in this vision. The company raised about $105 million in cryptocurrency Ether (ETH) by distributing its native QASH token in an initial coin offering (ICO) in November 2017.

At its peak, Liquid's following numbered in the tens of thousands via its main group on the Telegram messaging app, its subreddit forum on Reddit, and social channels. Many of them were QASH holders.

As an exchange token, QASH could be used to pay trading fees on the issuer's platform. In a video from that time, Lozada said other crypto exchanges were ready to adopt QASH and that banks and financial institutions would benefit. But only a handful of other crypto exchanges have listed QASH.

QASH was developed as an ERC-20 standard token running on the Ethereum network, but the project's white paper (a mix of prospectus and manifesto) called for the creation of a brand new blockchain by the second quarter of 2019. Switching to its own blockchain would increase QASH's value, Lozada said in the video.

Even in Liquid's glory days, things weren't quite what they seemed. Kayamori publicly claimed in March 2018 that the company was connected to more than 17 other exchanges. However, in internal Slack messages seen by CoinDesk, an employee wrote that "none of the 17 exchanges ever agreed to be part of the external" World Book, and that Liquid could only access Coinbase's liquidity by paying the U.S. company a fee. "We don't have a formal agreement with them," this employee said.

This year, the U.S. Securities and Exchange Commission (SEC) took action against many token issuers for selling unregistered securities to American buyers, but Liquid does not appear to have been on its radar. Internal records reviewed by CoinDesk show that 217 U.S. individuals purchased QASH tokens as part of the ICO. These U.S. citizens who participated in the sale purchased 10,294,721 tokens at a price of 24 cents each, for a total of $2 million.

TheSuccess of

the ICO meant that Liquid had its own token and roadmap. The token didn't crash right after its debut, as many others did. The company had money to spend.

"It meant Mike was promising all these things," said a former employee, who called the ICO a "blessing and a curse." QASH reached an all-time high of $2.45 on Jan. 14, 2018.

That same month, hackers captured $520 million from Japanese exchange Coincheck. The hack impacted every exchange in Japan.

"It spooked both institutional and retail investors, slowed the development of cryptocurrencies and led to stricter regulation," Lee said. "The crypto market in Japan is still struggling to recover from that hack."

Liquid was located in one of the most heavily regulated jurisdictions in the world for crypto. The JFSA launched a series of inspections and tightened rules.

To secure users' funds, the regulator mandated that most customer funds be held in cold wallets - with private keys or passwords stored in a hardware device disconnected from the Internet, or on a piece of paper locked in a safe.

The last major crypto bear market began in early 2018, and Liquid's financial health has been "impacted by the crypto market, but so solvent that they could run at this burn rate for another year and a half," a former employee said. The company had "at least tens of millions of dollars," this person said.

The exchange was growing, and the number of employees in the various offices increased from about 50 in 2017 to more than 300 in 2018, and management decided it was time to move to an office that reflected the future of the company.

In June 2018, the Japanese employees moved to Kyobashi Edogrand, a glass and steel building in one of Tokyo's most expensive neighborhoods. The company occupied more than 6,500 square meters of space and paid about $200,000 a month in rent, according to two former employees. The price was double the average in the city.

During that time, Liquid followed best security practices, two former employees recalled. The office had a heavily secured "signing room" for crypto transfers. Fingerprints were required to enter the airtight room (where the network was isolated from unsecured networks), and cameras monitored from inside and outside. Large withdrawals had to be signed off by an employee in Japan and another in the Vietnam office, and these were processed every few hours.

Management disputeOn22

. June 2018, Japanese regulators issued orders to Liquid exchange and five other crypto companies to improve their business operations and required them to improve their risk management practices. Liquid's improvement order hampered efforts to conduct new business in Japan, where half of its customer base is based.

Kayamori did not address the compliance issues and instead blamed employees for not generating more sales in Japan, according to four former employees.

The co-founders began to argue. Liquid informally split into two teams as each founder tried to oust the other, according to six former employees.

"Their weaknesses almost balanced each other out at first," said a source close to Liquid. "It got to the point where they couldn't even be in the same room".

"Mario was frustrated with the slow pace of development and repeated failures," a former employee explained. Lozada felt Kayamori had put the wrong people in key positions, according to another.

Lozada wanted to create Qryptos, a crypto-to-crypto exchange, to complement the exchange's main offering of trading between crypto and fiat currencies, the former employee explained. Kayamori decided to put a young and inexperienced employee in charge of the project, taking a week-long vacation two weeks before the launch.

It was the "right time, wrong person," the former employee said, pointing out that Binance launched around the same time and went on to become a highly successful crypto exchange.

While Lozada understood technical matters better than Kayamori, he was not particularly strong in execution, another former employee said. Lozada often yelled at younger employees and made fun of mistakes, he said.

Kayamori did the same, former employees said. "He was good and humble when he talked to me," one source said, but he also yelled at employees in team meetings and rhetorically asked why everyone was stupid and not doing their jobs well.

Open fights broke out in the public Slack channels. "They were just going crazy on Slack," recalled a source close to Liquid. Name-calling was pervasive. Team leaders referred to employees as "fucking idiots," "childish," and their work as "garbage

"

"Bizarre favoritism "

Liquid was highly undemocratic, according to two former employees. There were standards, but it didn't seem to matter if you met them. Managers gave bonuses to those close to them at their discretion.

Kayamori showed "bizarre favoritism," said another former employee, citing the appointment of SoftBank graduate Katsuya Konno as chief financial officer as an example.

This person recounted an incident in spring 2018 when Konno was working on the launch of Liquid, a Japan-focused mobile app. According to the former employee, Konno spent a lot of money on banner ads, with little monitoring of the ads' performance or targeting.

At some point, Liquid was notified that its Google advertising accounts were at risk of closure because $300,000 in bills had not been paid. A wire transfer from a bank would take too long to save the account. So a marketing department employee spent most of her day at a supermarket, making one small payment after another until the entire amount owed was transferred to Google.

Since the transfer limit at the supermarket is usually 250,000 yen (about $2,000), the marketing employee spent an estimated five hours making 150 transfers.

That same year, Liquid sold a large portion of the Ether raised in the ICO when the market was at its lowest point, according to two former employees.

"They held on to it, didn't secure any of it," one said, "and then sold in a panic."

Konno did not respond to a request for comment.

The feud

between the co-founders not only divided the company, but also led employees to work on a variety of initiatives and products

"When Mike and Mario were fighting over the company, there were several crazy 'Hail Mary' projects they were tackling," said a former employee.

Among Lozada's pet projects was a 100-fold leveraged contract for difference (CFD) called Liquid Infinity, which was launched in April 2019 for non-Japanese clients. Such highly leveraged contracts are typically a risky investment, and Liquid's own limitations made them even riskier.

"The low liquidity of the exchange meant that any mid-sized buy or sell could send the market soaring or crashing," explained a former employee. As a result of these dramatic swings, highly leveraged positions were more likely to be liquidated by traders, two former employees said.

Also in April 2019, Liquid announced a U.S.-based venture called Liquid USA. A person familiar with the project said Liquid's management insisted that Liquid USA allow "simple" accounts that do not require customer identity verification (KYC), even though such accounts generate little revenue and would likely be frowned upon by U.S. regulators.

The company relied on Liquid's technology, which this person described as a "giant albatross." The flagship Japanese exchange sometimes crashed, and management seemed to prioritize fancy tech over getting the fundamentals right. At the end of 2020, the project was canceled in the United States.

Throughout its history, Liquid has lost talented employees who were responsible for core products, according to five former employees.

"The good people have left, and you have people in roles that probably feel a little too big for them," said Norbert Gehrke, founder of Tokyo FinTech, a nonprofit organization of Japanese fintech enthusiasts. Gehrke invited Kayamori to speak to Tokyo FinTech members in 2017 and is familiar with other Liquid employees.

Double-counting

dealsLiquidkept

up appearances.

QASH held its value in November and early December 2018, while Bitcoin and Ether, the crypto market's leading currencies, fell.

This was at least partly due to the company buying its own tokens to keep the price at 21 cents, according to Slack messages reviewed by CoinDesk. It does not appear that Liquid publicly disclosed these purchases.

In other news, employees discussed the company's practice of double counting trades. While it is common in the industry for a trade to be counted only once, Liquid's system recorded each trade twice, once for the buy order and a second time for the sell order. For example, a trade of 1 BTC was recorded as 2 BTC. This reporting practice inflated the exchange's trading volume and made it appear more successful than it was.

Liquid continued to describe itself as "the safest exchange in the world" until 2019, although four former employees indicated that security had deteriorated at that time.

Two of those employees described an incident in which a customer service representative exploited a loophole in the backend to create fake accounts and use administrator privileges to withdraw small amounts of BTC and XRP from the company's wallets. The employee made off with around $30,000 worth of cryptocurrencies.

Liquid's now holey security frustrated some of its employees. One of them conducted a "pentest," or penetration test, in which he obtained wallet funds on a USB stick and handed the stick over to management to demonstrate how easy it was to breach security, according to two former employees. Pentests are a form of "white-hat" or benevolent hacking, comparable to testing your front door after you've locked it.

During that time, Kayamori's priority was getting Liquid ready for sale. In April 2019, he announced a Series C funding round of undisclosed amount, declaring Liquid a unicorn, one of only two billion-dollar companies in the Japanese startup scene.

"The funding round was structured just to reach that billion-dollar figure," said a source close to Liquid. The round was done in two parts; Liquid raised a larger amount of money at a lower valuation and then a small amount of money at the unicorn valuation, the source said, calling the decision "a sign of Mike Kayamori's hubris."

IEO for an IOUKayamoriand

Konno spent about $5 million of Liquid's ICO funds to buy allocations of GRAM tokens, which would be the native tokens for messaging app provider Telegram's ambitious blockchain project, the TON network

"Please work on this as if our survival depends on the success of the Gram IEO, because it really does," Kayamori told employees on Slack. (IEO stands for Initial Exchange Offering, a token sale managed by an exchange, which was a fashionable way to spread new crypto assets at the time).

Traders in private markets bought and sold IOUs for GRAM, although Telegram's token agreement prohibited buyers from selling their allocations until the network went live.

Liquid bought allocations not from Telegram itself, but from a company called Gram Asia, according to two former employees. Gram Asia, in turn, bought allotments from another party, and so on.

According to an internal document, compliance staff raised questions about supply risk, operational risk, and reputational risk. All in all, management wanted quick revenue.

In October 2019, the SEC sued Telegram for a violation of U.S. securities law, and the tokens were never minted. Liquid did not sell nearly the amount of GRAM tokens it had purchased, nor did it receive back the funds sent to Gram Asia, according to three former employees.

Liquid canceled the GRAM sale in January 2020 and refunded the money to investors. The exchange lost money on the IEO, at least $5 million, three former employees said.

Downgrading officesIn2020

Liquid saved costs by moving its Tokyo headquarters to a fourth-floor office, usually the cheapest because the number four bears an ominous resemblance to the Japanese word for death

The new office, which continues to house the company, was less than a quarter the size of the previous office. Unlike the previous headquarters, the new space had no beds, no café, and no private rooms; employees worked in an open-plan office.

The signature room was a thing of the past. By this time, Liquid had begun using the services of a crypto key management company called Unbound, which relies on a method called multi-party computation (MPC) or "warm wallet" technology.

Crypto exchanges weigh business interests against security risks. Users want quick withdrawals, but they also expect their funds to be safe. Cold or offline wallets are safe from hackers but slow down withdrawals. Hot wallets, which are connected to the internet, are riskier but allow for easy withdrawals. In 2019, MPC technology was a popular middle option, as one former Liquid employee recalls.

Executive spending continued despite the bureau's downgrade.

"They spent all the money from the ICO on stupid things," said a former employee, citing executives who took first-class flights between Vietnam and Japan.

There was pressure to make Liquid profitable quickly, which may have driven Kayamori to jump from one shiny thing to the next, four former employees said.

Listing feesLiquid took

five- and six-figure token listing fees totaling $250,000 from projects, an internal document reviewed by CoinDesk shows. Their tokens were generally listed on the global portion of the exchange, which is not available to Japanese customers. (The document shows a pending deal with a U.S.-based project that would pay $100,000 in addition to its $150,000 fee for a "Japan listing.")

Liquid was about to list the SHOPIN token before the SEC charged the project's CEO, Eran Eyal, with fraud. The company also listed the ARE token, only to delist it less than a year later.

At the same time, however, Liquid refused to list projects whose quality management recognized when they refused to pay listing fees, according to Slack messages seen by CoinDesk. (The lack of listing fees would not necessarily make listing a token unprofitable for the exchange if it could make money from trading fees over time.)

When asked by CoinDesk if he was reluctant to list high-value tokens and instead favored more dubious tokens, Seth Melamed, who led business development at Liquid until November 2019 before becoming chief operating officer, described listing digital assets as a "multi-layered process." Considerations included due diligence, timing and the cost of technology implementation, he said.

Liquid also allowed U.S. citizens to participate in dozens of ICOs and IEOs even though they were not registered as securities, risking putting the company in the SEC's crosshairs, a former employee said.

"There's still the question of whether the offer and sale of the tokens in question qualify as securities transactions, but it will definitely put the exchange on the SEC's radar if it wasn't there already," said Grant Gulovsen, an attorney in private practice who represents clients involved in crypto.

All the while, construction of the company's proprietary QASH blockchain was proceeding at a snail's pace.

"Not enough attention or manpower was put into it," said a former employee, recalling that six to seven developers spent a week each month building the QASH blockchain.

To become a successful Layer 1 or basic blockchain, the person said, QASH would have needed at least twice that number of developers, as well as a marketing campaign and plan to convince people to use the chain.

According to internal Slack news from the second half of 2019, management realized that Liquid would not meet ICO investors' expectations, such as the proprietary blockchain for QASH and the World Book.

Leak-driven marketingAlso

during

this period, Liquid took steps to capitalize on another company's mistake

In November 2019, Bitmex, a high-flying crypto derivatives exchange known for its leveraged futures contracts, announced that it had accidentally exposed tens of thousands of customer email addresses in the "cc" field of a mass mailing.

According to a former employee and Slack messages viewed by CoinDesk, Liquid came into possession of these addresses and matched them with those of its own users.

A marketing manager at Liquid wrote a plan to woo existing customers who had accounts at Bitmex, the former employee said, because those traders were likely users of Leverage. Liquid aimed to become their preferred place for leveraged trading.

It would have been too risky to target Bitmex customers who did not already have Liquid accounts, the former employee explained.

It is unclear if Liquid ever put this plan into action.

Personal Laptops forWorkIn early

2020, employees began working remotely due to the coronavirus pandemic. Kayamori was known for not turning on his camera during online meetings; employees heard only his voice. Some felt he left day-to-day operations to Chief Operating Officer Melamed.

From April to June 2020, some employees had to use their personal laptops for work.

"That was a red flag because this is a financial company" that should have provided secure devices to its employees, one former employee said. Liquid eventually solved the problem by redistributing laptops from departing employees to those who remained, the employee said.

"Instead of taking calculated risks, executives cut the company to pieces at the expense of individual employees," said another former employee. The company didn't spend money to capitalize on the bull market, or so-called DeFi Summer 2020, when decentralized financial protocols rewarded users with generous returns for lending their tokens, this person said.

Kayamori persuaded the board to vote Lozada out in mid-2020.

When asked by CoinDesk about his departure, Lozada said it was "amicable." He did not respond to questions about his performance as co-founder or the products and practices he launched.

Security lapsesA

disproportionate number of customer service representatives had access to user accounts at a level that allowed them to change user data, view wallet addresses and view funds, a former employee said

On Nov. 13, 2020, Liquid was hacked. The exchange blamed security flaws at domain registrar and web hosting company GoDaddy (GDDY).

The provider had "mistakenly transferred control of the account and domain to a malicious actor," Kayamori wrote at the time. GoDaddy did not respond to CoinDesk's request for comment.

Kayamori claimed customer funds had been accounted for and remained safe and secure. However, two former employees said the full extent of the November 2020 hack was never disclosed. Customer funds and a wealth of personal data had been stolen, they said.

"To the extent Mike ever thought about security at all, he considered it a product he could buy," one former employee said sardonically. "Yes, we bought security. ATale of

Two LiquidsThe competingJapanese

exchanges Coincheck and bitFlyer beat Liquid to the domestic market. The JFSA lifted the business improvement order in 2021, allowing Liquid to do new business in Japan, but the company needed capital.

Two stories circulated about Liquid's financial health. Results released in public channels and announced in weekly conference calls made Liquid look like it was doing well, two former employees from the practice said. The company was making most of its money from listing new tokens, making $200,000 to $600,000 in good months, they said.

But two former executives with knowledge of the company's finances said Liquid was profitable for only a few months in its lifetime, even with the 2020 and 2021 bull markets.

A source close to Liquid said management stopped reporting metrics only a few months after new product launches when the numbers didn't look good.

"That's not just for board decks, it's for their own internal data," the source said.

"The $90 million hackOn

Aug.

19

2021, Liquid suspended withdrawals and deposits. The company claimed it was hacked again. The size of the hack was later put at $90 million.

Three former employees said the hack drove Liquid's valuation down. The company was no longer a unicorn. A week after the hack, FTX extended a $120 million loan to the Japanese exchange.

Liquid said the money would go toward "accelerating new capital generation projects and providing critical liquidity." (FTX earned its reputation by offering derivatives and leveraged products.)

Within two months, the JFSA issued Liquid a Type 1 license, allowing it to offer derivatives in the Japanese market. Without a Type 1 license, exchanges can only offer cash trading. Without the loan from FTX, Liquid likely would not have received the Type 1 license, according to a former employee.

There is still no official explanation for what happened in the hack. Liquid has brought in security teams, including crisis management firm Blackpanda, to investigate the case.

"Blackpanda has stated that it has declined to comment on the matter out of respect for the confidentiality of all customers (past and future) in the crypto industry," CEO Gene Yu said.

Cold caseForensicinvestigations

into

the August 2021 hack have been suspended, two former employees said

"Halting a security review before a full report is basically the same as not getting a report," said Josh Smith, founder of Blockwell, which has been a vendor and external token auditor for Liquid for five years.

Liquid held non-Japanese users' balances in "warm" MPC wallets managed by Unbound because Singapore, which regulated that part of the business, did not require exchanges to hold balances in cold wallets.

One former employee said that before the hack, her access had been changed without her knowledge so that she could take balances out of the wallets, a task that was well outside her job description. When she learned that this had happened, the employee said she feared being made a scapegoat for the hack.

Another employee later claimed in court documents that this is exactly what happened to her.

Wrongful termination laws

uitOn

March28, 2022, Liquid's former product and marketing manager in Japan, Marisa McKnight, filed a wrongful termination lawsuit against Quoine, the official legal entity, claiming she was scapegoated

for the hack.

According to documents McKnight filed in the Singapore High Court, she initially had a positive and close working relationship with Liquid's management, but was later "increasingly excluded and isolated."

The documents allege that after McKnight was terminated in September 2021 (the month after the hack), she was told by Liquid's management that she was a suspect in the breach and told to fly to Japan.

McKnight claims she refused to travel there because of the severity of management's allegations, the two-week quarantine for travelers during COVID-19, and the fact that the company did not book her a hotel or return flight. She also stated in her complaint that Kayamori threatened her. Although she had given notice, Liquid fired her for cause in October 2021.

She is suing the company for the loss of 60 shares worth $210,000, as well as reputational damage and loss of future employment opportunities. On April 19, Quoine defended herself against McKnight's lawsuit, denying most of the allegations. She filed a reply on May 4, and the case is still ongoing.

MPC walletsFive other

former employees thought it highly unlikely that McKnight was involved in the hack

According to Smith, the Liquid provider, it was "virtually impossible" that McKnight hacked the exchange, given her job title, the access it provided and the fact that she was working remotely at the time. Smith's first job in the crypto industry was to shut down an ICO hack in mid-sale without losing a dollar, and he has consulted professionally on more than a dozen hacks.

Were Unbound's keys bypassed? Or did Liquid undermine Unbound's work with wallets whose entire private keys could be compromised?

"Nothing in Unbound's MPC protection mechanism was compromised, and the theft was in no way due to a weakness in Unbound's system," Unbound CEO Yehuda Lindell told CoinDesk. Lindell added that he was "not in a position to say what caused the theft."

A veteran Liquid vendor said details of previous hacks suggest Liquid at least partially disregarded a fundamental aspect of a secure system, namely different identities for different employees so the company knows exactly who is accessing internal systems and when.

If that sounds too abstract, think of the bank card in your wallet. Even if you have a joint account with a family member, each of you has your own card and PIN, so your monthly statement shows exactly who made each ATM withdrawal or purchase. But if you share your card and PIN with more than one person, there's no way to know which of them made which transaction.

"It doesn't matter how secure Unbound is if a single set of Unbound account credentials is shared," the Liquid vendor said.

Inside job?

A source close to Liquid at the time of the hack said that, in his opinion, the hack could not have been carried out by someone who was not directly involved in the implementation of the platform.

This source explained that a team called "DevOps" operates and maintains Liquid's systems and servers. The DevOps staff had built a system that only they knew how to operate. They weren't afraid of managers asking them to make changes.

Whoever was doing the hack "had to be someone who had built the system or worked with it frequently, because they only had one chance to do it right ... and they did it right," the source said.

When asked to describe

what happened in terms of a bank robbery analogy, this source replied,

"Two bank employees decide to rob the store. In the middle of the night, they open a rarely used side door that leads outside. They throw many bundles of money through that side door, then one ties up the other and beats him up. They try to make it look like an intruder came through that side door, took the guard by surprise, took his keys, took the cash, and fled to Neptune. "

Shut down

operations

for 90 days, immediately fire anyone remotely involved in the design, construction, or operation of the existing trading platform, and rebuild from scratch with unencumbered servers and engineers. "

FTX acquires LiquidFive months

after the hack, FTX announced it would acquire Liquid Group. It intended to buy all shares, stock options and warrants from shareholders, according to contracts reviewed by CoinDesk. The dates in the contracts are redacted.

A Liquid competitor, Japanese crypto exchange bitFlyer, was recently valued at up to $370 million. Gehrke said Liquid likely sold at a discount to bitFlyer's value as a result of the hack, possibly by $200 million. "From an FTX perspective, that's a bargain, right?" he said.

Another source close to Liquid said the company has about 40,000 shares. McKnight's complaint and a shareholder document seen by CoinDesk indicate the price per share was $3510.41, so the company would have sold for about $140 million based on that share count.

FTX declined to comment on Liquid's compliance and security issues and did not answer questions about its own due diligence on the acquisition.

The Liquid acquisition gave FTX the opportunity to offer derivatives in the Japanese market and acquired licenses at a favorable price. Japan has been reluctant to approve new licenses for crypto exchanges in recent years. Even Nasdaq-listed Coinbase, one of the world's most successful exchanges, did not receive a Japanese license until June 2021, three years after it announced plans to do business there.

On May 1, Kayamori confirmed in an email to shareholders from FTX's Bahamas office that the acquisition was complete and Liquid would now operate under the name FTX Japan. FTX plans to migrate its Japanese customers to Liquid's platform. Investors will be able to exchange Liquid's QASH token for FTX's FTT.

In his email, Kayamori said his vision for Liquid has been to provide financial services for all.

"We knew it wouldn't be easy, but to be honest, I never thought it would be this difficult either," he wrote. "But as the 19th century German philosopher Friedrich Nietzsche once said, 'What doesn't kill you only makes you stronger.' And we were able to defy all the challenges to become part of the FTX family. "

Liquid IEO / Token Listing ... by CoinDeskLiquidToken

Listing Fees by CoinDesk

11 20220328 HC S 258 of 2022 Statement of Claim - 202211445 by CoinDesk on Scribd

12 Liquid defense 20220419 HC S 258 of 2022 - Defense - 202211444 by CoinDesk on S

cribd

13 20220504 Reply S 259 by Co

inDesk on Scribd