Case file: FTX and Sam Bankman-Fried. Sources linked at the end as [S#]. SEC and CFTC complaints are allegations. General information only, not financial advice.

On 11 November 2022, a restructuring veteran named John J. Ray III took control of a crypto empire. His first act was to put it into bankruptcy [S1]. Then he went looking for the books.

There was no accurate list of the bank accounts, and no accurate list of who could sign on them [S2]. Expense requests went through a chat app, and supervisors approved spending, in his words, “by responding with personalized emojis” [S3].

Ray had cleaned up after Enron. A week in, he told the court: “Never in my career have I seen such a complete failure of corporate controls and such a complete absence of trustworthy financial information as occurred here” [S4].

And yet the company had clean audit opinions. Two of them [S5].

Two companies, one owner

FTX was an exchange: customers deposited money and crypto, and traded. By 2022, according to the Second Circuit, FTX customers were trading around $10–15 billion a day [S6]. Alameda Research was a trading firm Bankman-Fried founded in 2017 and ran until he stepped down as its CEO in 2021. The appeals court noted it was FTX’s largest customer and main market maker [S6].

Ray’s first-day filing says Alameda was owned 90% by Bankman-Fried and 10% by co-founder Gary Wang, with no independent governance between Alameda and the international exchange business [S7].

Red flag: one owner on both sides. When one person controls the exchange and the biggest trader on it, every balance between them is suspect until proven clean. Who owes whom, how much, and can they pay?

The custody of crypto was worse. Ray’s filing lists an unsecured group email account used as the root user to access confidential private keys, and “the absence of daily reconciliation of positions on the blockchain” [S8]. Reconciliation is the most basic control in finance: every day, check that what your records say you hold matches what you actually hold. If nobody reconciles, nobody inside may even know money has gone missing.

The back door

On an exchange, if a trader’s losses get too big, the system sells them out automatically. Ray’s filing describes “the secret exemption of Alameda from certain aspects of FTX.com’s auto-liquidation protocol” [S8], and lists “the use of software to conceal the misuse of customer funds” among the failures [S8].

At trial, the government’s case was that customer money flowed into Alameda and was spent. Caroline Ellison, Alameda’s former CEO, testified under a cooperation agreement. According to the Second Circuit’s summary, she testified that Bankman-Fried directed her to use FTX customer funds to repay Alameda’s lenders and to send a lender a false balance sheet [S9]. Ellison and Wang pleaded guilty in December 2022 [S10]; Nishad Singh, FTX’s former head of engineering, in February 2023 [S11].

Red flag: management override. Controls only work if the people at the top can’t switch them off.

The auditors

FTX was split into what Ray called silos. Armanino audited the US business; Prager Metis audited the international exchange, FTX Trading. Both gave opinions on the 2021 financial statements [S5]. Ray wrote that he was professionally familiar with Armanino but not with Prager Metis, noting its website called it the “first-ever CPA firm to officially open its Metaverse headquarters in the metaverse platform Decentraland” [S5]. He added: “I have substantial concerns as to the information presented in these audited financial statements, especially with respect to the Dotcom Silo” [S12].

In 2024 the bankruptcy court’s independent examiner, Robert J. Cleary, published a report summarising investigators’ findings on both audits. It doesn’t name the firms; it calls them Auditor-1 and Auditor-2. What it says about each lines up with the engagements Ray described, so linking them to Armanino and Prager Metis is our inference [S13].

On the FTX US auditor, the examiner reported that it flagged money owed to customers as high risk, planned four substantive tests on more than $200 million due to customers, and completed one. On related-party balances, it simply asked Bankman-Fried to confirm them [S13]. On the FTX Trading auditor, the examiner reported it sought only Bankman-Fried’s confirmation of a $1.2 billion receivable owed by Alameda, and, though it identified segregation of customer assets as a significant fraud risk, failed to investigate unusual transactions that would have revealed customer funds weren’t being kept separate [S13].

Red flag: the echo confirmation. Asking the owner to confirm what the owner’s company owes the owner’s other company isn’t evidence. Get something from outside the family: a bank statement, a third party, a ledger they don’t control.

The regulators come for an auditor

In September 2024 Prager Metis settled SEC charges without admitting or denying the findings. The SEC alleged its two FTX audit reports falsely represented that the audits complied with generally accepted auditing standards, and that Prager didn’t adequately assess whether it had the competence and resources to audit FTX [S14]. It agreed to a $745,000 penalty, an independent consultant and limits on new audit clients; with a separate, earlier, non-FTX independence matter resolved the same day, the total came to $1.95 million [S14].

No SEC or PCAOB action against Armanino over FTX turned up in the primary sources we reviewed; it has been sued by FTX customers in private class actions [S15]. And according to the examiner, FTX US fired its auditor in September 2022, after that auditor sent draft letters flagging “Material Weaknesses” and “Significant Deficiencies” in internal controls [S13]. The warning was being drafted weeks before the collapse.

Seven days in November

In November 2022 customers rushed to withdraw. An exchange that really holds customers’ money can pay them. FTX couldn’t. Ray filed for Chapter 11 on 11 November [S1]. By his first-day declaration his team had secured about $740 million of crypto in new cold wallets, “only a fraction” of what they hoped to recover [S16].

On 13 December 2022, regulators filed. The SEC alleged Bankman-Fried raised more than $1.8 billion from equity investors while hiding the diversion of customer funds to Alameda [S17]. The CFTC alleged customer deposits were commingled with Alameda’s and that customers lost more than $8 billion [S18]. In February 2023 the CFTC alleged Singh built or maintained code features favouring Alameda, including a “can withdraw below borrow” functionality [S18].

The verdict and the appeal

On 2 November 2023, after a trial of about a month in Manhattan, a jury found Bankman-Fried guilty on all seven counts: two of wire fraud and five conspiracy counts covering wire fraud, securities fraud, commodities fraud and money laundering [S19]. US Attorney Damian Williams said: “This case has always been about lying, cheating, and stealing, and we have no patience for it” [S19].

On 28 March 2024 Judge Lewis Kaplan sentenced him to 25 years and ordered about $11 billion in forfeiture. The DOJ said he defrauded FTX investors of more than $1.7 billion and Alameda’s lenders of more than $1.3 billion [S20]. On 12 June 2026 the Second Circuit affirmed the conviction, sentence and forfeiture, writing that he used FTX as “his own personal piggy bank” [S6][S9].

It isn’t quite over. In September 2026 he petitioned the US Supreme Court (No. 26-349) on what loss evidence a jury can hear and whether the forfeiture breaches the Eighth Amendment. The petition is pending; the government’s response is due in November [S21].

What an auditor takes from this

Line them up: no accurate list of bank accounts. Spending approved by emoji. One trader exempt from the rules. Related-party balances “confirmed” by the man on both sides. An auditor that, according to the examiner, flagged material weaknesses and was fired soon after. None of these needs a forensic genius. They need someone to ask boring questions and refuse a one-word answer.

Ray’s first job, by his own account, was building the accounting, audit, cash management and risk systems that “did not exist, or did not exist to an appropriate degree” [S22]. The cleanup began by installing what an audit is supposed to test.

Watch the full case file: https://youtu.be/pBH4xPdi1HY · Free download: 10 Accounting Red Flags, subscribe to the newsletter

Sources

General information only, not financial advice. Prager Metis settled without admitting or denying. The examiner’s report doesn’t name the audit firms.