alphafi on sui · may 2025 to sep 2026 · @kitty4DHD

alphafi wound down. here's what the chain says happened.

on sep 25 2026 at 23:09 utc alphafi tweeted that it was "winding down in an orderly way." i had a withdrawal ticket in its ALPHA vault at the time, so i went & read the chain. this section is everything i found: the 68 minutes before the tweet, the lock that didn't actually unlock everyone, the $17.1M of bad debt & the 4 positions behind it, & the september sequence that paid it off. i'm not saying i know who anyone is. every claim links to a tx so you can check me.

the numbers

head start
68 min
on-chain wind down began before the tweet
bad debt repaid
$17,129,783
sep 20 2026, one transaction, nine loans
positions behind it
4
5.7M ALPHA posted, 57% of supply
still locked
51 tickets
86,672 ALPHA, after the "lock removed" tweet
ALPHA
-97%
within about 25 minutes of the tweet
fee wallet today
~$2,300
across 104 coin types, sep 27

the short version

  • the shutdown started on chain at 22:01:01, 68 minutes before anyone was told. emergency mode on 7 slush & loop pools, then at 22:16:48 the ALPHA vault's 28 day lock went to 0, then at 22:47:59 borrowing was cut on all 36 alphalend markets. the tweet came at 23:09:29. the 68 minutes.
  • exactly one wallet claimed ALPHA from the vault b/w the lock change & the tweet: 0x59faca57…4725, 11,566 ALPHA at 22:35:54, sold by 23:04. the other 25 receipts in that batch (23,729 ALPHA) didn't move.
  • the lock change didn't unlock everyone. a ticket gets its unlock date stamped at the weekly settle & the contract enforces the stamp. 51 requests settled aug 30 to sep 20 (86,672 ALPHA) still say sep 27 to oct 18. those people unstaked by the rules & got to watch ALPHA go from ~$0.93 to ~$0.02 from inside the lock. the vault lock.
  • that one early wallet is part of a cluster of at least five linked by funding & timing. four of them pulled all their alphalend collateral b/w 18:02 & 18:15, five hours before the tweet, on an otherwise boring afternoon. the cluster has done business w alphafi's treasury wallets since nov 2024: 38 BTC relayed for conversion, 50k ALPHA & 100k USDT in one evening, OTC ALPHA buys. who moved early.
  • idear.sui, the other big seller, also left alphalend early (44,318 SUI at 17:29) & had been paid 25,404 USDC by alphafi wallets over the prior year. purpose unknown. i have guesses.
  • the ~$17.1M of bad debt was paid on sep 20 at 22:50 by a wallet created on sep 14. so the problem was known at least 11 days before the announcement. the four positions were opened may to dec 2025 by four wallets that alphafi's fee wallet gasses, funds, or receives borrowed money from. the protocol booked their ALPHA at $2.77, $3.65 & $14.16 while it traded around $1. the bad debt.
  • the fee wallet held the ownership caps of all four. september reads as a workout, not a heist: the fee wallet spent its treasury on repayments, concentrated the leftover debt on one ALPHA-only position, handed its real collateral to the rescue side, which paid about $27.6M, liquidated about $12M of security through exchange accounts, & released the users' ALPHA. the fee wallet holds about $2,300 today. september.
  • none of this proves who these people are, or whether the early movers were tipped vs being the team itself. both readings are bad for alphafi. the chain shows what moved & when. it does not show intent. method & corrections has everything i got wrong along the way, cuz there was some of that.

the pages

roughly in the order things happened. the oracle timeline is the older piece that started this & the rest builds on it.

the cast

short names i use everywhere. every link opens the wallet on suiscan in a new tab. "treasury" & "rescue side" are my labels, based on what the wallets do, not on anything anyone signed.

alphafi operated

vault admin0xe25b5d16ca31ddfdc31a7219c90f88bdfc56b606c13df6619aef22515580e293changed the lock, ran the settles, paused deposits, activated emergency mode on the pools, did the package upgrades.
keeper0x5c455d275a6cd3d9bb5bf91f8a47bffc07574b5df0960093e016a33c6987de9cthe bot. thousands of oracle updates & autocompounds; moves settled batches into the claim pot. received P2's 3.26M ALPHA on sep 25 & paid the queue out of it.
lending admin0xa1eb94d1700652aa85b417b46fa6775575b8b98d3352d864fb5146eb45d335fbmarket limits, flow limiters, interest rate configs, rewards on alphalend.
fee wallet0xee5360c5fa13555cbf355cb5015b865d742040e42ff90c324e11f0c63e504545the ALPHA vault's fee_address, set by the admin. gassed the position creators, held all four caps, did the september repayments. ~$2,300 left.
f71e (treasury ops)0xf71e0bc45d84bba3e1ab09c8ae636735da6f2b8d8bb2481fb5b437b537b0e65bfunds alphalend rewards, pays the keeper, receives strategy withdrawal batches, makes payroll-shaped payouts. its alphalend position became the security package.
1d1c (treasury)0x1d1c10469d6571d6a5b433b41a31a9b3e7fbe7b610e0b86603a7b3021f890af63.2M ALPHA (32% of supply) passed through it in six weeks of late 2025. also opened P4.
7c260x7c26d29cd738999e76d3587ef5c39d0210ffaf46c2476b9f1dd6c9264afbe011hub for 1d1c's transfers, receives the WBTC output of the BTC conversions.
w9273 (treasury-side, OTC)0x927363c465a04495ba8a88085ab12a3ee9902c3775601aeb8fa897b4ab564742the fee wallet's most frequent recipient since aug 2026. sent the cluster 50k ALPHA & 100k USDT, sent the P2 creator its 2.39M ALPHA.
6a490x6a498c57c18306e0af942442a5d20e5b2940939b4937ed52f4b17e3fa99972f5gets 500k USDC blocks from treasury wallets. queued a vault withdrawal 4.5 minutes after the lock change.

rescue side

bailout wallet0x3c2830dc5e138e9eb15b69e5e10a187f2898ab98a9f62ae2838b545d4f787a07created sep 14, paid the $17.1M on sep 20 (FK6jAgAP…).
0x5f81 (holds the caps)0x5f81363f48573dd002e09f34217ed00976afa748731bce61ea03e155f918d475fresh on sep 7, gassed by the fee wallet, received all five PositionCaps.
0xf2f10xf2f17b9b6d9e0c27ad8ab7eeffa7eb16a99710882b9b7fa331853bef0aad4dadfresh on sep 7, gassed by the hot wallet below. fed 0x5f81 the 10.5M USDC, then emptied f71e's position & bridged it out.
0xe6c90xe6c9fae4e4c39d561261484d3d1b1fce6a79e27a8ee5fc6718b3f922f9227dacsent 0xf2f1 the 10,544,043 USDC. fed by exchange-style wallets.
hot wallet 0x03b60x03b61aa716ed743fe9c0a58b8e7cc9e1b8d8b4f63bb955d19fe28e7b7d5de72eexchange-style (dozens of recipients an hour). gassed 0xf2f1 & the bailout wallet, sent the bailout wallet 1.5M SUI, & got the SUI & WAL back at the end.

cluster A

a0270x027feedba1873a796656a39087961cc633a44b6374df32df532e1a18439d4b92main wallet since march 2024. claimed 214,001 ALPHA 12 minutes after the tweet.
a59f0x59faca57f3c57f9d9cc105e041c3b0e78ba6621d21fc297e1ba1ebec7de34725created by a027 in aug 2025. the pre-tweet claimer & seller.
parent0xbef197ee83f9c4962f46f271a50af25301585121e116173be25cd86286378e15funded a027 in march 2024, got its leftover 152,897 ALPHA after the crash.
big52340x52345456ce3bca1b2f5015b7721e32ea3e69dd59a11f7987620a8f9fae935dc9funded a027 w 692k SUI & more. exited alphalend at 18:12.
stash0x1a1cfbf5f6f22510818808268237413d458bbe3ade5281c585d78d12583bea43got 110,892 ALPHA from parent at 00:10 on sep 26; still holds ~100k of it.

idear group

idear.sui0xe35e28c2a7272e73d692259ec83890828e959561145061e6cce37b8b8172827cclaimed 121,044 ALPHA at 23:21:05 & sold all of it in three minutes.
cold wallet0x743ae7fb585ddf0bb3c65da752a82599e899b428b8ed16e04a7e36d0f871b9f5two outgoing txs ever. where idear parked 34,100 SUI that afternoon.
siblings0xa3a4f368…c99e · 0x26079121…de76both feed the cold wallet, both left alphalend b/w 18:29 & 18:40.

the position creators

0x4dde (P1)0x4dde66fc52ec16d5e6c0fbd0968580cdf0d962cbb970591ec1e47617b9265617opened it w SUI six days before alphalend's public launch.
0xdfe2 (P2)0xdfe220ae0e20b1cfbe94800d957564ec3d6b444467a33825b790ef3e4a90a2degassed by the fee wallet 29 minutes before opening it w 2.39M ALPHA.
0xa66f (P3)0xa66fea423c5fcd3453b56cdd3ac137c0d9f89bfdfa242f70e5fec34cb483fea5the nov 2025 loop wallet. borrowed & forwarded to f71e, then to the fee wallet.
0x1d1c (P4)0x1d1c10469d6571d6a5b433b41a31a9b3e7fbe7b610e0b86603a7b3021f890af6the treasury wallet above. posted 2.24M ALPHA booked at $31.66M.

position labels P1 to P4 follow the oracle timeline page (P1 = 0x9e9d, P2 = 0x74d3, P3 = 0xd439, P4 = 0xf0a4). a few of the receipts cards use different letters; the receipts page says which. times are utc. i'm one person w a public rpc endpoint, not an auditor, & the write-up behind this has been through six revisions of me finding my own mistakes.

the tweet that started it: my sep 26 post. the thread w the receipts: thread 1. alphafi's own announcement: @AlphaFiSUI. the defiant's story: alphafi winds down after oracle error.