how i read this, what i got wrong, & what i can't prove

sources & tools

• sui json-rpc via sui-rpc.publicnode.com, rpc-mainnet.suiscan.xyz & sui-mainnet-endpoint.blockvision.org (the public fullnode dropped json-rpc). past object versions from suiscan, nodeinfra, tatum & blockvision, cuz publicnode & suiet prune history.
• queries: suix_queryTransactionBlocks w FromAddress / ToAddress / MoveFunction filters, suix_queryEvents, sui_getTransactionBlock w balance changes, events & inputs, sui_tryGetPastObject, sui_getNormalizedMoveModulesByPackage, suix_getOwnedObjects, suix_getDynamicFields.
• trades & candles: api.geckoterminal.com (pool trades w tx_from_address, OHLCV), api.dexscreener.com, api.coingecko.com. tweets: api.fxtwitter.com/status/{id}, no login, timestamps to the second.
• ethereum side: blockscout's api & etherscan's address labels (that's where "Kraken: Hot Wallet 2" comes from). bitcoin side: mempool.space. the tBTC redemption's destination was decoded from the approveAndCall extra data (a P2WPKH output script), then bech32 encoded.
• decimals: SUI, ALPHA, stSUI, WAL, BLUE 9; USDC, USDT, DEEP, USDSUI 6; xBTC, tBTC, WBTC, BTC 8. SUI/USD of 1.199 is taken from idear.sui's own 71,500 SUI to 85,729 USDC swap at 23:27:53 on sep 25.
• the scripts ran from a throwaway scratch folder & aren't preserved; everything cited can be re-derived from the digests, which is why every one of them is a link.

reading the vault tickets

pending UserWithdrawRequest tickets sit inside each position's withdraw_requests VecMap (sui_getObject on the position; in the json it's entries w fields.key & fields.value.fields). claimed ones move to all_withdrawals, an ObjectTable (suix_getDynamicFields, then sui_multiGetObjects). each ticket carries time_of_request, time_of_acceptance, time_of_unlock, time_of_claim, status (1 pending, 2 claimed) & token_amount. the pool is 0x06a49223…a6f8; its InitiateWithdraw / Settle / ClaimWithdraw events are typed under the original package 0x97543070…, not the current one, which cost me an hour.

the dry run

lock enforcement was tested w sui_devInspectTransactionBlock through @mysten/sui (SuiJsonRpcClient), building a user_claim_withdraw call exactly like a real claim & having the node execute it as the ticket's owner. nothing signed, nothing committed, nobody's wallet touched. the claim on the 56,770 ALPHA ticket stamped oct 14 aborts w code 1006 in update_all_withdrawals_and_get_amount; the same call on an unclaimed ticket from the 22:30:59 batch succeeds. details on the vault lock.

reading the positions

alphalend position ids are dynamic fields under the positions table 0x9923cec7…91ba of the LendingProtocol object 0x01d9cf05…0b93, keyed by {type "0x2::object::ID", value}. suix_getDynamicFieldObject w that key returns the position w its collateral & loans. PositionCap objects carry a position_id field, which is how the cap handoffs on sep 7 were matched to positions. loan_bailout's signature came from sui_getNormalizedMoveFunction on the lending package 0xe48b33ef….

position labels

this site labels the four positions the way the oracle timeline does. my working notes & the first three thread 2 receipts cards used a different order. the addresses are what matter:

things i got wrong first

in roughly the order i found them. the write-up behind these pages went through six revisions in two days & most of the changes were me being wrong in public. keeping the list.

• my original tweet (sep 26↗) said a027 sold ~$197k 18 minutes after the tweet & ~$11k 18 minutes before. the chain: a027 claimed 214,001 ALPHA (~$197k at $0.92) & sold 61,104 of it for ~$27k; the pre-tweet ~$11k was a59f, not a027, which was idle from 18:16 to 23:21. the dollar figures were explorer valuations of what moved, not sale proceeds. idear's ~$111k was really ~$85.5k in SUI.
• "nobody else was exiting that afternoon." a draft line in thread 1 said the cluster left alphalend on an afternoon when nobody else was. wrong: 5 to 17 wallets an hour were exiting all day. what's true is there was no rush until the tweet. i posted a correction reply.
• the fall to $0.14. an early summary blamed idear.sui for it. the candles put idear's swaps at $0.92 to $0.58 & a027's sales 14 to 18 minutes after the tweet at the drop to $0.14.
• "wallets that pay into the fee wallet." i described f71e & 1d1c that way early, implying they operate it. paying fees into a fee address is what any user does. the treasury attribution now rests on the behavior listed on who moved early.
• the 6 tBTC from the fee wallet to a027 looked like a payment. it was a conversion job: a027 kept none of the 38 BTC-equivalents it handled.
• "only 8 wallets queued" on sep 21 was misleading wording. eight is two to four times the normal daily count. it's a lot, not a little.
• 35 days. i'd said the unlock was 35 days cuz the app says so. the on-chain lock was 28 days from the weekly settlement; 35 is the worst case. i also had the settle on saturdays. it's sundays 14:00 utc. measured on 278 tickets.
• the 22:01 tx was first summarized as a manual oracle push cuz only its first commands got printed. it also activates emergency mode on seven pools & zeroes the WAL loop lock, so the on-chain wind down starts 68 minutes before the tweet, not 53.
• the bailout total was $16.3M w eight repayments until a ninth RepayEvent (10.15 xBTC on P4, $822,749) turned up. it's $17,129,783 & nine calls, & the 94.86 xBTC now reconciles. i also had loan_bailout listed as an admin function; its signature takes no capability at all, which is the whole point.
• a027's reaction time was "24 seconds" until i found the pool state after the 23:20:29 process call (392,280 ALPHA). it's 35 seconds after the pot could cover it.
• four DEEP amounts had been divided by 1e9 instead of 1e6 (DEEP has 6 decimals): 1,103 DEEP, 326,336 DEEP, 1,068,232 DEEP, 2,608,000 DEEP.
• "one owner" for the cluster became "linked by funding & synchronized behavior." "within 21 minutes" became "about 25 minutes." "six minutes" became "seven minutes." small, but they add up to a habit of rounding toward the story.
• "made every queued request eligible immediately" was too broad. a ticket's unlock date is stamped at settlement & the contract enforces it (dry run), so the lock change reached only the 22:30:59 batch & later requests. 51 tickets (86,672 ALPHA) stayed locked. the batch split is now exact too (a027 214,001; 0x6bf6 22,147; a59f 11,566; 23 others 1,582), replacing "about 23,700 over roughly 24 wallets." a request from sep 21 would normally have unlocked oct 25, not "around oct 19."
• "the collateral stayed where it was" & "none of the four position owners has signed a tx since." wrong & misleading, respectively. P2's 3,261,824 ALPHA was withdrawn on sep 25 at 11:39 by the wallet holding its cap, & the caps had moved to the fee wallet on or before sep 4 & to a fresh wallet on sep 7. the creator wallets being quiet meant nothing.
• the heist. the first version of september read as: the team pulled the real collateral & bridged it away. the wallet that did it sits on the rescue side (funded & gassed w the bailout wallet, proceeds into kraken & the same exchange accounts), the fee wallet had itself consolidated that collateral into the handed-over position, & the fee wallet is now empty. i had a whole thread drafted. it's in the receipts page as "never posted." the bridge totals also got refined: 24.64 tBTC, 68.65 WBTC, 118.77 ETH.
• two numbers from a parallel set of notes that i didn't adopt: ALPHA on 2025-12-03 was $0.95 w a $9.27M market cap per coingecko (not ~$1.18 & ~$11.5M), so the oracle mark was 14.9x market, not 12x; & P4's first two hours of borrowing were about $9.3M at the protocol's own values, not $29M.

what is not proven

• who controls cluster A or idear.sui, & whether the treasury relationship is employment, investment, market making or OTC dealing.
• whose money the 10,544,043 USDC of sep 7 was (0xe6c9… to 0xf2f1… to 0x5f81…). 0xe6c9 was fed by exchange-style wallets including the one that sent the bailout wallet its 8.4M USDC, & it cycled another 20M USDC back to exchanges.
• whether the rescue-side wallets (the bailout wallet, 0xf2f1, 0xe6c9) are the sui foundation's own or an agent's. they're funded from & return assets to the same exchange accounts; on ethereum the recovered ETH went into kraken. the foundation's statement is the only attribution.
• whether anyone was told about the 22:16 lock change, or just saw "claimable" appear in the app. the 25 other receipts in the 22:30:59 batch would have seen it if they were looking; one acted before the tweet.
• whether anything was said in alphafi's discord or telegram b/w 17:00 & 23:09 utc. chain data can't see that. no wayback machine snapshots of alphafi.xyz exist for sep 24 to 27.
• why idear.sui & the a027 cluster both exited alphalend b/w 17:29 & 18:15 while the rest of the day was routine. the admin's flow-limiter removal at 17:30:52 sits in the middle of that window.
• who the people behind the four position creators are, & whether the ALPHA oracle was misconfigured by accident or on purpose. the mark went $2.77 (june), $3.65 (august), $14.16 (december) while the market fell toward $1. i have said what i think about that.
• ALPHA's market price on 2025-06-25 & 2025-08-24 (no free price history reaches that far).
• what the app displayed as the unlock date to users w pending requests before sep 25 (the stamped settle-plus-28 date, or request-plus-35). no snapshot exists.
• what the pool field time_from_locking_period_for_unstaking_to_start (also 2,419,200,000 ms) does; it doesn't enter the ticket arithmetic.

glossary

• ALPHA vault / ember pool: the staking vault for the ALPHA token. deposit ALPHA, get a receipt, earn rewards, wait a lock period to leave.
• ticket: a UserWithdrawRequest inside your vault position. created when you initiate, stamped when the admin settles, paid when you claim.
• settle: the admin's weekly settle_requests_manual, sundays 14:00 utc give or take. it stamps every pending ticket's unlock date as settle time plus the lock.
• the pot: claimable_balance, the shared pool of ALPHA that claims are paid from. the keeper fills it one settled batch at a time.
• alphalend: alphafi's lending protocol. 36 markets. positions hold collateral & loans.
• PositionCap: the ownership object of an alphalend position. hold it, & you can borrow against, repay & withdraw from that position.
• loan_bailout: a public alphalend function that lets anyone repay any position's loan by id, w no capability. the normal repay needs the cap.
• oracle mark / booked: the value the protocol wrote into its own events for a deposit, i.e. what it believed the collateral was worth.
• fee wallet: the vault's fee_address, set by the admin. where protocol fees go.
• cluster A: my name for the a027 group of wallets. rescue side: my name for the bailout wallet, 0x5f81, 0xf2f1, 0xe6c9 & the hot wallet that funds them. treasury: my name for f71e, 1d1c, 7c26, w9273 & 6a49, based on behavior.
• t0: 2026-09-25 23:09:29 utc, the alphafi tweet. "+12m" means twelve minutes after it.