sep 4 & 5the hubs
hub f71e & w9273 sweep their treasuries into the fee wallet
f71e sends 13M DEEP, 2.77M WAL, 435,600 SUI, 2.03 WBTC, 3.9 tBTC & stables on sep 4; w9273 does the same on sep 5. this is where the repayment money comes from.
sep 4 to 27 2026 · sui, ethereum, bitcoin · times utc
september: the fee wallet held the caps, & then it didn't
a PositionCap is the ownership object of an alphalend position. whoever holds it can borrow, repay & withdraw. alphafi's fee wallet held the caps of all four bad-debt positions. what it did w them b/w sep 4 & sep 25 reads to me like a workout, not a heist. i drafted the heist version first. then i followed the bridged coins to where they landed & the chain didn't agree w me.
since when
the fee wallet didn't pick up the caps in september. it had two of them since december 2025, & used them.
| utc | what | tx |
|---|---|---|
| 2025-12-04 01:52:55 | P4's PositionCap 0x97961279…3b3c moves from its creator 0x1d1c to the fee wallet, seventeen hours after the position was opened | 4aRRNY9A… |
| 2025-12-04 20:07 & 12-06 00:22 | the fee wallet borrows $2.30M & $2.00M on P4, during two LTV-to-94 windows of six & four minutes | |
| 2025-12-07 20:33 | the fee wallet deposits 337,592 ALPHA into P4, booked $4.64M ($13.75 each, AVAX) | H7nrCtsa… |
| 2025-12-09 18:38 | the fee wallet deposits 248,565 ALPHA into P4, booked $3.62M; P4 borrows $1.26M | DC4gC4cM… |
| 2025-12-17 10:47 to 14:09 | the fee wallet moves 1,000,008 ALPHA from P4 to P3 (withdrawn at $12.30M, deposited at $12.30M), w the cap raised to 100M for it | ALnDtJkH… CSKYnQne… |
| 2025-12-25 16:43 to 20:33 | the fee wallet pulls $15.5M of ALPHA (booked) out of P3, takes P2's PositionCap 0x918a2da5…7f0a from its creator 0xdfe2 at 16:53, & deposits 1,215,262 ALPHA into P2 at 20:33, booked $15.09M. P2 borrows $2.27M | 74drTaJ6… DZTwkD7G… |
| 2026-01-01 to 01-20 | the fee wallet borrows $4.0M more on P4 & $1.5M on P3. P3's last refresh, jan 16: 2,082,087 ALPHA booked $28.2M |
when it got P1's & P3's caps i don't know exactly; it had all five by sep 7, cuz it handed them over. how the market's cap & LTV were opened around each of these deposits is the gate.
the sequence
purple = the fee wallet, green = money coming in from the rescue side, red = collateral going out, blue = alphafi admin wallets. every line re-read from the transactions.
sep 4 18:44 to sep 6 17:15fee wallet
the fee wallet repays on P4, P3 & P2 from its own balance
13,004,043 DEEP (C99qtYVf…), 2,778,203 WAL, 426,276 SUI, 404,692 USDT, 536,636 USDT, 1,326,743 WAL (P3), 640,357 WAL (P2), 23,609,923 DEEP, 6,046,829 WAL, 11 tBTC, 3 WBTC (P4), 963,044 USDT, more. only a cap holder can repay. so the fee wallet held the caps.
sep 6 16:41:52 to 17:13:06fee wallet
the debt shift: seven borrows against P2, each repaid within a minute on another position
P2 was backed only by ALPHA. the positions the money went to held real assets. their collateral was then withdrawn. net: 5,695,574 USDC + 23.8 xBTC of debt moved onto the ALPHA-only position. table below.
sep 6 16:50 to 17:17fee wallet
the pulled collateral goes into hub f71e's position
45.98 WBTC (J9iHSRkt…), 1,044,211 stSUI (BJ5DKTf8…), 46,770 SUI (H2kkgUYc…), plus smaller deposits on sep 5 & 6. f71e's position 0x16d704cc…c31f became the security package. this is the step i missed the first time, & it's the one that flips the reading.
sep 7 17:00:27fee wallet
the fee wallet gasses a fresh wallet, 0x5f81, w 5 SUI
sep 7 17:03 to 17:27fee wallet
& sends it five PositionCaps: P1, P3, P4, f71e's position, P2
the fee wallet held the caps of all four bad-debt positions. now a wallet that's 27 minutes old does.
sep 7 15:58 to 20:22rescue side
a second fresh wallet, 0xf2f1, is gassed by the hot wallet & receives 10,544,043 USDC
0xf2f17b9b…4dad gassed by 0x03b6…, the same hot wallet that gasses & funds the bailout wallet a week later. the USDC (4,000,000 & 6,544,043) comes from 0xe6c9fae4…7dac.
sep 8 01:33:18
0x5f81 passes the f71e-position cap to 0xf2f1
the security package changes hands to the side w the money.
sep 8 16:41 to sep 9 02:20rescue side
0xf2f1 feeds 0x5f81 10,544,097 USDC in ten transfers; 0x5f81 repays 8,000,000 on P4 & 2,544,097 on P2
sep 14 17:27 to sep 15 16:25rescue side
the bailout wallet is created & funded
5 SUI & 5 USDC from the hot wallet, then 95.3 xBTC, 1,060,061 USDT & 4,651,500 DEEP from 0x4eb81816…e5cd, then 8,400,000 USDC from 0x60956e40…449b. 80,000 USDT more on sep 18, 1.5M SUI on sep 23.
sep 18 07:14 to sep 19 04:57vault admin
four package upgrades
sep 20 05:58 to 06:24vault admin
the vault admin pushes pyth lazer oracle updates by hand
unusual; the keeper normally does this. it does it again on sep 24 & sep 25 (12 pushes b/w 10:13 & 13:02).
sep 20 22:50:17rescue side
the bailout: loan_bailout on all four positions, $17,129,783
94.86 xBTC, 8,299,475 USDC, 1,059,669 USDT, 4,630,460 DEEP. anatomy on the bad debt.
sep 20 23:36 to sep 22 12:53rescue side
0xf2f1 empties f71e's position: 30 pulls
1,500,000 & 1,174,777 stSUI (redeemed to 2,776,160 SUI), 68.6 WBTC in 14 pulls, 15 & 9.5 tBTC, 111.3 & 7.5 ETH, 23,678,167 IKA, 918,321 BLUE, 359,593 WAL, 42,815 USDT, 30.3 XAUM, 253 wormhole SOL. its debt had been moved onto P2 on sep 6, & the bailout had just paid P2. so this came out clean.
sep 21 02:10 to sep 25 04:30rescue side
& off sui, or into deposit addresses
118.77 ETH through the sui bridge, 24.65 tBTC through threshold's gateway, 68.65 WBTC through layerzero, 2,783,990 SUI to two fresh wallets, 360,861 WAL to a third. where all of that landed is the table below.
sep 21
ALPHA rises to $0.91 (from $0.62 on sep 15). eight wallets queue vault withdrawals vs the usual one to three
including a59f at 12:29:42 & a027 at 17:16:27. the day after the bailout, four days before the tweet. i'm sure this is fine.
sep 25 11:38:51lending admin
the ALPHA market's outflow limiter is switched off
update_flow_limiter on one market: (false, 0, 3600). 48 seconds before the withdrawal below. cool coincidence.
sep 25 11:39:390x5f81
0x5f81 withdraws all 3,261,823.818 ALPHA from P2
P2 has no debt anymore (the bailout paid it) so its collateral is free. the ALPHA-only position gives up its ALPHA.
sep 25 11:43:01
& sends it to the keeper
the keeper, alphafi's bot. so the ALPHA that had been collateral for $17M of loans is now the vault's payout float.
sep 25 22:16:48vault admin
the vault lock goes to 0. the shutdown night begins
sep 25 22:36 to sep 26 13:05keeper
the keeper pays the vault's withdrawal queue out of that ALPHA
81,145 at 22:36:58, 249,296 at 23:20:29, 126,244 at 23:20:40, 333,262 at 00:48:04 & more: 1,347,016 ALPHA net across 33 calls. the keeper still holds 2,111,550. the pot that paid a027's 214,001 claim at 23:21:04 was topped up 35 seconds earlier from this.
sep 27
where it stands
P2 holds nothing & has no loans. P1 holds 1,759,328 ALPHA & 35 WAL, P3 2,082,087 ALPHA, P4 1,822,439 ALPHA, no loans. all four caps sit in 0x5f81. read from the positions table 0x9923cec7…91ba under the LendingProtocol object 0x01d9cf05…0b93.
the debt shift, sep 6
every row signed by the fee wallet. borrow & repay events name the positions. P2 is 0x74d35b41…, the position backed only by ALPHA (3.26M of it that day, marked $7.63 each by the oracle). 0x2065…, 0x16d7… (f71e's position) & 0xe663… held real assets.
| utc | borrow against P2 | then repay on | then withdraw from |
|---|---|---|---|
| 16:41:52 | 1,012,240 USDC FeM4bX5E… | 0x2065… 4gPgsv85… | |
| 16:46:44 | 6.31 xBTC GAqcErjP… | 0x2065… 8osFkky5… | 0x2065… DkGV2D16… |
| 16:59:22 | 3.8 xBTC BLuEqxTw… | 0x16d7… (f71e) Gm6L41vX… | |
| 17:00:32 | 3,551,828 USDC AUHp6aWy… | 0x16d7… (f71e) HcfjZuuw… | |
| 17:02:36 | 1,131,506 USDC Ho75AfHe… | 0x16d7… (f71e) Eeen79am… | |
| 17:10:56 | 8.46 xBTC 9FZ7sbAE… | 0xe663… 5iYMAKYD… | |
| 17:12:01 | 5.23 xBTC 6bAJNaiZ… | 0xe663… AUMWC3Pb… | 0xe663… GHYjotNd… Gsurbzra… HPnUaTXh… |
net effect: 5,695,574 USDC + 23.8 xBTC of debt moved onto the position backed only by ALPHA, & the positions w real collateral were freed up. fourteen days later the bailout paid P2. read one way, that's parking the loss where the foundation would eat it. read the other way, it's tidying the book so the security package (f71e's position, which the fee wallet then topped up w the freed collateral) could be handed over clean. the next step is what decides it.
the 10.5M USDC
on sep 7, hours after the caps moved to 0x5f81, a wallet called 0xe6c9… sent 10,544,043 USDC to 0xf2f1…, which fed it to 0x5f81 in ten transfers on sep 8 & 9. 0x5f81 used it to repay 8,000,000 USDC on P4 & 2,544,097 on P2. whose money that was is not visible on chain. 0xe6c9 was fed by exchange-style wallets including 0x6095…, which also sent the bailout wallet its 8.4M USDC, & it cycled another 20M USDC back to exchanges. same plumbing as the bailout. so i put it on the rescue side.
where the collateral went
i followed every bridge leg to the other side. this is the part that turned my heist into a workout: the proceeds went into exchange accounts on the side that had just paid $27.6M, not into anyone's pocket on the alphafi side.
| asset | route | landed |
|---|---|---|
| 118.66 ETH | sui bridge, sep 21 | 0xe7204fcb…e73c on ethereum, then 118 ETH to 0xA2DbC53d…5b0c (0xe25c7eae…), & six minutes later to 0xf30ba13e…0EB0, which etherscan labels "Kraken: Hot Wallet 2." a deposit address sweeping into an exchange. |
| 68.65 WBTC | layerzero, sep 23 to 24 | same ethereum landing address, then to 0x6D23946D…4739, which was gassed by & swept into 0xFf6e3701…C102, a wallet w 20,000 WBTC transfers & no public label. same deposit-and-sweep shape. |
| 24.64 tBTC | threshold gateway, sep 22 to 23 | redeemed on ethereum for native BTC to bc1qkxsq00…fcp4 (24.59 BTC received), which sent 23.59 BTC to 3HCFrE6ZDA…Vgtx & 1 BTC to 3Frj4jFN2e…12hm; both then swept in exchange-style consolidation txs (295 to 1,198 BTC each). |
| 2,783,990 SUI | plain transfers, sep 21 & 23 | to 0x5684663d…c552 (1,555,000) & 0x4a994ad2…3f6b (1,228,990), two "fresh" wallets that each forwarded everything within a minute to 0x03b61aa7…e72e, the exchange hot wallet that gassed 0xf2f1 & gassed and funded the bailout wallet. deposit addresses. |
| 360,861 WAL | plain transfer, sep 25 | to 0x921fa162…4af3, same pattern, same hot wallet. |
| the rest | 23.7M IKA, 918k BLUE, 42.8k USDT, 30 XAUM, 253 SOL: under $1M together. |
paid by the rescue side
~$27.6M
10.5M USDC (sep 8 to 9) + $17.1M (sep 20)
security liquidated
~$12M
2.78M SUI ~$3.2M, 68.65 WBTC ~$5.6M, 24.6 BTC ~$2.0M, 118.8 ETH ~$0.5M, rest under $1M. sep 27 prices, rough
fee wallet, sep 27
~$2,300
across 104 coin types. no bridge calls, no transfer above 25,368 USDC since sep 6