17:29:10idear
idear.sui removes 44,317.6 SUI of alphalend collateral
idear.sui is the wallet that sells 121k ALPHA twelve minutes after the tweet. this is its first move of the day.
sep 25 2026 · sui mainnet · times utc
the on-chain shutdown started 68 minutes before the tweet
t0 is the alphafi tweet at 23:09:29 utc. everything below is what alphafi's own admin wallets did before it, who moved in the gap, & what happened after. not really sure if running the shutdown for an hour & then announcing it is normal. mb it is. the wallets that moved in that hour are the interesting part either way.
the announcements
three organizations posting within seven minutes of each other. timestamps from the public tweet api, to the second.
| utc | account | what it said |
|---|---|---|
| 23:09:29 | @AlphaFiSUI | "AlphaFi is winding down in an orderly way. The protocol is in maintenance mode: withdrawals remain open, but users cannot take new loans." |
| 23:09:30 | @AlphaFiSUI | borrow positions against ALPHA collateral became substantially undercollateralised, bad debt, sui foundation security team flagged it, "That bad debt has now been fully covered" |
| 23:09:31 | @AlphaFiSUI | new supplies & borrows disabled |
| 23:09:31 | @AlphaFiSUI | slush strategies withdrawable, WAL vault lock removed |
| 23:09:32 | @AlphaFiSUI | "The ALPHA vault has been discontinued, and its lock period has been removed. You can withdraw ALPHA at any time." |
| 23:09:33 | @AlphaFiSUI | "Making users whole was the priority, and it took support from the @SuiFoundation" |
| 23:09:34 | @AlphaFiSUI | supporting the foundation's investigation, "recovery of the amounts owed is being pursued" |
| 23:09:34 | @AlphaFiSUI | will see the wind down through until the last user has withdrawn |
| 23:13:07 | @SlushWallet | slush users told to withdraw from the SUI, WAL, DEEP & USDC strategies |
| 23:15:51 | @SuiNetwork | sui security team identified the ALPHA oracle misconfiguration; sui foundation will "provide assistance in order to ensure that the protocol is wholly solvent. No user funds are impacted." |
| sep 26 00:27 | the defiant | "AlphaFi Winds Down After Oracle Error, With Sui Foundation Support." defillama had $63.5M of TVL in the lending markets at 21:31 utc that day. |
the afternoon: two groups leave alphalend
17:29 to 18:40. nobody else was in a hurry. alphalend exits ran at 5 to 17 wallets an hour all day until the tweet, then 117 in the 23:00 hour & 844 in the next.
17:30:52lending admin
flow limiter set to (false, 0, 3,600,000 ms) on all 36 markets
i read this as the withdrawal rate limits being switched off. it sits in the middle of the window where the two groups below leave. mb unrelated. it's a weird 102 seconds either way.
17:43 to 17:52idear
idear swaps 10,000 SUI to 11,215.8 USDC & parks 34,100 SUI in a cold wallet
the cold wallet 0x743ae7fb…b9f5 has two outgoing txs ever. then idear does nothing for five hours.
18:02:50 to 18:05:09cluster A
a59f removes all its alphalend collateral: 5,542.4 SUI, 8.4 stSUI, 316.3 BLUE, 4.6 USDC
a59f is the wallet that claims from the vault before the tweet. four txs, two minutes.
18:05:34 to 18:07:02cluster A
parent removes collateral, claims 1 ALPHA, queues a fresh vault withdrawal
parent is the wallet that funded a027 back in march 2024. queuing a withdrawal at 18:07 means it was in the batch the admin settled at 22:30:59.
18:10:57 to 18:16:12cluster A
a027 removes 1,103.4 DEEP & 28,286.2 SUI of collateral, collects rewards
a027 then goes idle until 23:21:04, when it claims 214,001 ALPHA.
18:12:43 to 18:14:51cluster A
big5234 removes everything: 2,994 USDC, 1,909 USDT, 336,575 WAL, 1,068,232 DEEP, 12,534 SUI
big5234 funded a027 w 692,070 SUI among other things. 50 txs in 8 months, so not an exchange. six txs here, then rewards.
18:18:48cluster A
parent sells 1 ALPHA for 0.80 SUI
a test, as far as i can tell. checking the route works before you need it.
18:29:49 & 18:39:39idear
idear's sibling wallets leave alphalend too (small amounts)
0xa3a4f368…c99e & 0x26079121…de76, both of which feed the same cold wallet.
| hour (utc) | exit txs | unique wallets | cluster A txs |
|---|---|---|---|
| 11 | 44 | 12 | 0 |
| 12 | 26 | 17 | 0 |
| 13 | 16 | 12 | 0 |
| 14 | 21 | 9 | 0 |
| 15 | 39 | 15 | 0 |
| 16 | 11 | 6 | 0 |
| 17 | 9 | 6 | 0 (idear's 44k SUI is here) |
| 18 | 29 | 15 | 12 |
| 19 | 22 | 7 | 0 |
| 20 | 16 | 7 | 0 |
| 21 | 10 | 5 | 0 |
| 22 | 16 | 10 | 0 |
| 23 | 263 | 117 | 0 |
| 00 (sep 26) | 1,027 | 844 | 0 |
remove_collateral + withdraw calls on alphalend. the 18:00 hour is the two groups above plus noise.
the runbook: 22:01 to 23:09
every admin action in the hour before the tweet, w the one wallet that moved in the gap. blue = alphafi admin wallets, green = claims from the vault, red = sales.
22:01:01vault admin
emergency mode on seven slush & loop pools, WAL loop lock to 0
after a routine oracle update in the same tx, the vault admin calls admin_activate_emergency on the slush SUI, USDC, WAL & DEEP pools, the WAL & USDSUI locked-loop pools & the stSUI/SUI loop pool, plus set_locking_period<WAL>(0). this is the first on-chain wind down step. 68 minutes before the tweet.
22:16:48vault admin
ALPHA vault locking_period: 2,419,200,000 ms (28 days) to 0
on the pool object 0x06a49223…. applies to requests settled from now on. the 51 tickets already settled b/w aug 30 & sep 20 keep their stamped october dates. the vault lock has the whole mechanism.
22:21:16treasury payee
6a49 queues a vault withdrawal, 4.5 minutes after the lock change
6a49 receives 500k USDC blocks from alphafi's treasury wallets. it migrated a legacy receipt & queued in the same tx. no claim seen through sep 26. not really sure what to make of a treasury payee reacting to an unannounced admin change inside five minutes. i'm sure it's fine.
22:23:33keeper
process_withdraw_requests_manual: the oldest matured batch (1,008 ALPHA) into the claim pot
22:27:46
0xb061 queues a withdrawal
0xb0615e45…5c20. claimed 0 at 23:18.
22:30:44vault admin
initialize_airdrop_manual (reward distribution)
22:30:59vault admin
settle_requests_manual: a batch of 249,296 ALPHA, every ticket stamped unlock = right now
26 withdrawing receipts, everything queued since sep 20: a027 214,001 (86% of the batch), 0x6bf60b81…121b 22,147, a59f 11,566, & 23 smaller receipts holding 1,582 between them. with the lock at 0 they're all claimable the moment this lands. the same settle processed 19 deposits totalling 693 ALPHA.
22:35:54cluster A
a59f claims 11,566 ALPHA. the only claim b/w the lock change & the tweet
the claim pot drops from 28,413 to 16,847, exactly 11,566. 25 other receipts in the same batch could have done this. none did.
22:36:07 to 22:37:09keeper
process_withdraw_requests_manual seven times: the seven old batches (126,137 ALPHA) into the pot
pot now 142,984. the tickets behind the aug 30 to sep 20 batches keep their stamped unlock dates, so their 86,672 ALPHA sat in the shared pot without being claimable by them. by others, yes.
22:41:51
last successful borrow on alphalend
22:46:36 & 22:47:59cluster A
a59f sells 1,000 ALPHA twice (800.7 & 796.9 SUI)
22:47:59lending admin
update_market_limits on all 36 markets: borrow cap 0
borrowing disabled by the lending admin. 21 minutes before the tweet says "users cannot take new loans."
23:04:11cluster A
a59f sells 9,566 ALPHA for 7,429.35 SUI
that's all of it. 11,566 ALPHA claimed at 22:35, 11,566 sold by 23:04, about $10.8k in SUI. five minutes before the tweet.
23:04:38
0x6d29 queues a withdrawal
0x6d292ddc…d8af, five minutes before the tweet.
23:09:26lending admin
flow limiter on all 36 markets back to (true, per-market cap, 3,600,000 ms)
rate limits back on w new caps, three seconds before the tweet. the runbook's last line.
23:09:29t0
the tweet
"AlphaFi is winding down in an orderly way." eight posts in five seconds. slush follows at 23:13:07, sui at 23:15:51.
after the tweet: 23:09 to 00:10
how 25 minutes took ALPHA from $0.92 to $0.02. two wallets did most of it.
23:16:28 to 23:19:18
the first post-tweet withdrawal requests
0xa3a4f368…c99e (idear's sibling, +7m), then three others, then idear.sui itself at 23:19:18, the fifth wallet to react.
23:20:10 / 23:20:29 / 23:20:40vault admin + keeper
settle (new batch 126,244 ALPHA, mostly idear's 121,044), then two process calls
pot 392,280 after the first process call, which is the first moment a027's 214,001 could be paid. 518,524 after the second.
23:20:56
0x0831 claims 5,008 ALPHA
0x0831763f…8551, a regular user as far as i can tell. queued at 23:17, claimed here.
23:21:04cluster A
a027 claims 214,001.28 ALPHA, 35 seconds after the pot could cover it
the pot that paid this was topped up at 23:20:29 from the ALPHA pulled out of position P2 that morning. september has that story.
23:21:05idear
idear.sui claims 121,044.23 ALPHA
23:21:34 to 23:24:24idear
idear sells all 121,044 ALPHA in six swaps for 71,349.47 SUI
fills at $0.85, $0.75, $0.66, $0.61, $0.57, $0.55. ALPHA goes from ~$0.92 to ~$0.58. about $85.5k realized.
23:23:36cluster A
a027 sells 5,555 ALPHA for 2,723.16 SUI
23:25:22cluster A
a027 sells 49,548.84 ALPHA for 23,508.53 USDC through the 7k aggregator. ALPHA to ~$0.14
this is the trade that broke it. everyone after this was selling into nothing.
23:27:26 to 23:35:03cluster A
a027 sells six lots of 1,000 ALPHA for 146.9, 25.6, 24.4, 25.1, 23.9 & 22.0 USDC
watch the numbers. that's the market disappearing in real time.
23:27:53idear
idear swaps 71,500 SUI to 85,729.31 USDC
SUI at $1.199 by this trade, which is the SUI price i use everywhere on these pages.
23:35:48cluster A
a027 hands its leftover 152,897.45 ALPHA to parent
23:40:14 to 00:01:09cluster A
parent dumps ~42,000 ALPHA in 1,000 lots into empty pools for 823 USDC + 634 SUI
about $1,600 for 42k tokens that were worth ~$39k an hour earlier. whoever ran this had information & no execution.
23:43 to 23:46idear
idear unwinds what's left on alphalend & slush (20,327 USDSUI, 1,602 WAL)
sep 26 00:04:49vault admin
set_pause: deposits paused
00:10:09cluster A
parent moves 110,891.98 ALPHA to a stash wallet
the stash then sells 100 ALPHA at a time for ~1.7 SUI each from 01:16 onward. it still held 100,181.98 ALPHA on sep 26.
the price
five minute candles from the bluefin ALPHA/USDC pool 0x6595edf6…. ALPHA traded b/w $0.93 & $0.96 all afternoon; the last candle before the tweet closed at $0.915. it had climbed from $0.62 on sep 15 to $0.91 on sep 21, the day after the bailout. cool timing.
| utc | open | low | close | volume $ | note |
|---|---|---|---|---|---|
| 22:45 | 0.9595 | 0.9567 | 0.9567 | 22 | |
| 23:05 | 0.9567 | 0.9154 | 0.9154 | ~0 | a59f's 23:04:11 sale is in the stSUI pool ($8,792); this pool's drop printed on nothing |
| 23:20 | 0.9164 | 0.5490 | 0.5490 | 955 | idear's six swaps + a027's 5,555 sale, mostly in the stSUI pool ($94,208 there) |
| 23:25 | 0.5490 | 0.0632 | 0.0632 | 4,962 | a027's 49,549 aggregator sale |
| 23:30 | 0.0632 | 0.0221 | 0.0240 | 847 | the low. 21 to 26 minutes after the tweet |
| 23:45 | 0.0287 | 0.0204 | 0.0224 | 493 | |
| 00:30 | 0.0202 | 0.0202 | 0.0205 | 16 |
by sep 26 05:00 utc geckoterminal had it at $0.0322, coingecko at $0.0549, & dexscreener's headline pair said $0.463. that last one is the bluefin ALPHA/stSUI pool's tick price w 411,587 ALPHA & 17.6 stSUI left in it: a number w no bid behind it. real executable price was $0.02 to $0.03. market cap went from ~$9.3M to ~$0.3M. i got $2 for my 107 ALPHA, which tracks.
claims from the vault, 48 hours around t0
the full list of who took ALPHA out, so you can see how quiet it was before & how not quiet after.
| utc | wallet | ALPHA | tx |
|---|---|---|---|
| 09-24 00:12:02 | 0xe1af4bb0…16e2 | 27 | 3LHwHUcJ… |
| 09-25 07:21 to 07:23 | 0xd1a5622b…b4dd | 11 tiny claims | |
| 09-25 10:49:29 | 0xdc2e499e…e273 | 0 | ELUiNgsN… |
| 09-25 15:12:05 | 0x40db335d…599f | 2 | JBgb1rxk… |
| 09-25 18:06:47 | parent 0xbef197ee…8e15 | 1 | 6ivtbfeg… |
| 09-25 22:35:54 | a59f 0x59faca57…4725 | 11,566 | 5hsRUH5c… |
| 09-25 23:18:37 | 0xb0615e45…5c20 | 0 | CGv8SRaE… |
| 09-25 23:20:56 | 0x0831763f…8551 | 5,008 | 7YkxbmYR… |
| 09-25 23:21:04 | a027 0x027feedb…4b92 | 214,001 | 7pEzxkWr… |
| 09-25 23:21:05 | idear.sui 0xe35e28c2…827c | 121,044 | B7ivSfEb… |
| 09-25 23:25:39 | 0x2279521f…f9ff | 11,762 | 6f7mrWkM… |
| 09-25 23:34:36 | 0x26079121…de76 (idear sibling) | 16,163 | 9zituTsh… |
| 09-25 23:41:28 | 0xace47d46…6fde | 117,385 | DYMyFkMt… |
| 09-25 23:56:31 | 0x0865effe…30b4 | 25,651 | BfJcdsaK… |
| 09-26 02:03:20 | 0xea0bc2c5…a309 | 21,776 | 6XsbcRvF… |
| 09-26 03:09:37 | 0xa9f91018…3fd8 | 162,220 | DqdcQJcD… |
| 09-26 03:18:39 | 0x6dcc33a7…e1d6 | 144,920 | 7JNvE5ZC… |
plus about 25 smaller claims b/w 23:27 & 03:00 (1 to 3,750 ALPHA each), mine included. the wallets i show only as a prefix are ones i didn't capture in full; the tx link gets you there.
who sold, 6 hours before to 3 hours after
dex sellers above $500 across the three main ALPHA pools, from geckoterminal trade data. a59f was the only wallet selling more than $500 of ALPHA b/w the lock change & the tweet.
| realized usd | trades | window | wallet |
|---|---|---|---|
| 90,415 | 8 | +12m to +15m | idear.sui 0xe35e28c2…827c |
| 17,048 | 8 | +14m to +16m | a027 0x027feedb…4b92 (partial; the aggregator routed the rest elsewhere) |
| 10,610 | 3 | -23m to -5m | a59f 0x59faca57…4725 |
| 1,344 | 2 | +12m to +13m | 0xbfd9fa07…dda2 |
| 958 | 1 | +30m | 0x4f76e8ee…2681 |
| 865 | 1 | +12m | 0xe1ea42d7…1fec |
| 743 | 1 | +20m | 0x2279521f…f9ff |
| 696 | 1 | +16m | 0x0831763f…8551 |