But aren't they themselves (FTX) custodians of these funds? In that case, why not turn their services off to protect the keys from being hacked? What you say makes sense once a hack takes place, but how did the hackers get the keys? Or do they use external custodians?
It's most likely an inside job, either by disgruntled employees or SBF himself:
"In a subsequent examination, FTX legal and finance teams also learned that Bankman-Fried implemented what the two people described as a "backdoor" in FTX's book-keeping system, which was built using bespoke software.
They said the "backdoor" allowed Bankman-Fried to execute commands that could alter the company's financial records without alerting other people, including external auditors. This set-up meant that the movement of the $10 billion in funds to Alameda did not trigger internal compliance or accounting red flags at FTX, they said." [1]
That is truly astonishing. How did he think he could get away with it?
I kept wondering how someone who seemed smart, wanted to help others, and admitted that crypto is a Ponzi scheme could end up in crypto. It broke my brain.
Now I see he was a brazen criminal all along and the world makes sense again.
