alphafi wound down. here's what the chain says happened.
on sep 25 2026 at 23:09 utc alphafi tweeted that it was "winding down in an orderly way." i had a withdrawal ticket in its ALPHA vault at the time, so i went & read the chain. this section is everything i found: the 68 minutes before the tweet, the lock that didn't actually unlock everyone, the $17.1M of bad debt & the 4 positions behind it, & the september sequence that paid it off. i'm not saying i know who anyone is. every claim links to a tx so you can check me.
the numbers
the short version
- the shutdown started on chain at 22:01:01, 68 minutes before anyone was told. emergency mode on 7 slush & loop pools, then at 22:16:48 the ALPHA vault's 28 day lock went to 0, then at 22:47:59 borrowing was cut on all 36 alphalend markets. the tweet came at 23:09:29. the 68 minutes.
- exactly one wallet claimed ALPHA from the vault b/w the lock change & the tweet: 0x59faca57…4725, 11,566 ALPHA at 22:35:54, sold by 23:04. the other 25 receipts in that batch (23,729 ALPHA) didn't move.
- the lock change didn't unlock everyone. a ticket gets its unlock date stamped at the weekly settle & the contract enforces the stamp. 51 requests settled aug 30 to sep 20 (86,672 ALPHA) still say sep 27 to oct 18. those people unstaked by the rules & got to watch ALPHA go from ~$0.93 to ~$0.02 from inside the lock. the vault lock.
- that one early wallet is part of a cluster of at least five linked by funding & timing. four of them pulled all their alphalend collateral b/w 18:02 & 18:15, five hours before the tweet, on an otherwise boring afternoon. the cluster has done business w alphafi's treasury wallets since nov 2024: 38 BTC relayed for conversion, 50k ALPHA & 100k USDT in one evening, OTC ALPHA buys. who moved early.
- idear.sui, the other big seller, also left alphalend early (44,318 SUI at 17:29) & had been paid 25,404 USDC by alphafi wallets over the prior year. purpose unknown. i have guesses.
- the ~$17.1M of bad debt was paid on sep 20 at 22:50 by a wallet created on sep 14. so the problem was known at least 11 days before the announcement. the four positions were opened may to dec 2025 by four wallets that alphafi's fee wallet gasses, funds, or receives borrowed money from. the protocol booked their ALPHA at $2.77, $3.65 & $14.16 while it traded around $1. the bad debt.
- the fee wallet held the ownership caps of all four. september reads as a workout, not a heist: the fee wallet spent its treasury on repayments, concentrated the leftover debt on one ALPHA-only position, handed its real collateral to the rescue side, which paid about $27.6M, liquidated about $12M of security through exchange accounts, & released the users' ALPHA. the fee wallet holds about $2,300 today. september.
- none of this proves who these people are, or whether the early movers were tipped vs being the team itself. both readings are bad for alphafi. the chain shows what moved & when. it does not show intent. method & corrections has everything i got wrong along the way, cuz there was some of that.
the pages
roughly in the order things happened. the oracle timeline is the older piece that started this & the rest builds on it.
the ALPHA oracle timeline
every change the alphalend admin made to how ALPHA was priced, lined up w what the 4 positions were doing. the chart of booked vs market price lives here.
01 · sep 25 2026the 68 minutes
what alphafi's admin wallets did before the tweet, who moved in the gap, & the 25 minutes after it. w candles.
02 · the afternoonwho moved early
the a027 cluster, idear.sui, & how both connect to alphafi's treasury wallets. what they are isn't on chain.
03 · mechanicsthe vault lock
35 days vs 28, how a withdrawal actually works, why the lock change reached one batch, & the 51 tickets it didn't.
04 · may to dec 2025the bad debt
the $17.1M bailout tx, the 4 positions, who opened them, & the nov 2025 loop through the fee wallet.
05 · may 2025 to sep 2026the gate
where the $14 came from (SUI, stSUI, gold, then an APT entry pointed at AVAX), & how the deposit cap, LTV & liquidation settings were opened for minutes at a time.
06 · sep 4 to 27 2026september
the fee wallet held the caps. the debt shift, the 10.5M USDC, the bailout, the pull-out, & where the collateral went.
07 · imagesreceipts
the cards from the twitter threads, w every digest, so you can paste them into an explorer.
08 · fine printmethod & corrections
how i read this, what i got wrong first, what i still can't prove, & a glossary.
the cast
short names i use everywhere. every link opens the wallet on suiscan in a new tab. "treasury" & "rescue side" are my labels, based on what the wallets do, not on anything anyone signed.
alphafi operated
rescue side
cluster A
idear group
the position creators
position labels P1 to P4 follow the oracle timeline page (P1 = 0x9e9d, P2 = 0x74d3, P3 = 0xd439, P4 = 0xf0a4). a few of the receipts cards use different letters; the receipts page says which. times are utc. i'm one person w a public rpc endpoint, not an auditor, & the write-up behind this has been through six revisions of me finding my own mistakes.
the tweet that started it: my sep 26 post. the thread w the receipts: thread 1. alphafi's own announcement: @AlphaFiSUI. the defiant's story: alphafi winds down after oracle error.