who paid for the bad debt & who backed the validator

what's been said

@SuiNetwork, sep 25 2026 23:15:51↗ (archived), six minutes after alphafi's own announcement: it credits the sui security team w identifying the "misconfiguration of their ALPHA oracle and subsequent creation of bad debt" & says the foundation made the decision to provide assistance so the protocol is "wholly solvent". alphafi's own thread never uses the word oracle & never says who repaid or how much. nobody has put a number on it. the only number is the chain's: $17,129,783 in one transaction on sep 20 (the bad debt), plus 10.54M USDC repaid on sep 8 & 9.

the validator's 30M

on 2025-01-21 at 02:01:06, 0x341fa71e… staked exactly 30,000,000 SUI w the alphafi validator (BmwKjH4H…). 30M is the minimum stake a validator needs to join & it joined the same day, at the next epoch change. the stake (0x6671ba2f…) sat there untouched through the shutdown: about 92% of the validator's 32.69M SUI (8% commission). alphafi's own stSUI staked 864k there.

how it got in, all times utc:

• jan 15 2025, 21:57:13: 0xa0920b07… registers as a validator candidate (BkMTSkSR…).
• jan 15 to jan 21, 00:28: it asks to join 11 times. all 11 fail (first: 4KEywAqs…, last: Db3aJKjr…). it didn't have the stake to qualify.
• jan 21, 02:01:06: the 30M lands.
• jan 21, 17:17:32: the 12th request goes through (N4yCVgB7…).
• jan 21, 17:38:21: epoch 650 starts & alphafi is in the active set, ~15.5 hours after the 30M.

then it left. on oct 6 2026 at 19:42:24 the same wallet withdrew it (4Y9Mrsz2…) & got back 30,951,314.61 SUI, principal plus 20 months of rewards. it wasn't only alphafi: at 18:08 the same evening it also pulled 15.9M from hoh.zone, the validator of a sui developer community (EprdRNcD…). & this wallet moves its delegations all the time: 279 withdrawals since jan 2024, usually on weekdays b/w ~16:00 & 23:00 utc, often in batches. oct 6 fits that pattern, so i wouldn't read the date as a reaction to anything. it was the same day raj's x account went private, but that may be coincidence. what does stand out is how late it is: the stake stayed four weeks into the rescue (what the foundation knew & when).

then alphafi moved its own. on oct 9 at 05:26:10 alphafi's vault admin, the wallet that zeroed the vault lock on shutdown night, changed stSUI's validator list (8A21yGcz…). all ~879k SUI behind stSUI left alphafi's own validator for Mysten-1, mysten labs'. it was that wallet's only tx since oct 6. then on oct 11 the validator's own wallet unstaked its commission, 105 txs, 14,336 SUI. the validator had 1.65M SUI on oct 8 & 751,367 on oct 11, when sui put it on the at-risk list for sitting below the minimum.

then the validator quit. the same day at 17:02:21 its wallet asked to leave (FhjhfWAC…) & sui dropped it at the next epoch change, oct 12 at 00:05:42, marked as a voluntary exit. alphafi's validator is gone. at 02:37 that wallet sent everything it had left, 14,682 SUI (the commission it unstaked the day before plus its last rewards), to 0x862d2bfd… (Bc9kvGKE…), which put it into a leveraged staked-SUI position on suilend 87 seconds later (4EN8a1Xo…). an hour after that the lending admin swept alphalend's staking rewards (B7Z8wBUc…) & its market fees in 17 coins (DunKmS8S…) into the same wallet. it's a wallet the lending admin first funded & on oct 15 it put 119,309 USDC into the gate account (exits), pulled from suilend two minutes before, so not the validator's SUI coin for coin.

whose wallet is it? independent analysts have called 0x341fa71e the sui foundation's since 2023: @clayop, aug 2023↗ ("the foundation address 0x341fa", in korean) & @defioasis, oct 2024↗, who traces its downstream wallets to the foundation. the foundation has never confirmed or denied it & no explorer tags it. on chain it's a genesis allocation (one of its stake objects, 0x826681ef…, 20M SUI, was created in sui's genesis transaction already owned by it & sat untouched until sep 10 2026) that moved hundreds of millions of SUI at mainnet launch & has given joining-size stakes to at least 24 of today's validators within two epochs of each going live (anchorage digital, cetus, suilend, navi, bucket, ledger by p2p, ankr & more), plus mysten labs' own. it behaves like a validator delegation program.

& raj said so himself. on may 29 2025 at 04:38↗, replying to four pillars about the cetus recovery vote: "Most validators are supported by Foundation stake because you need 30 million SUI to run a validator. For example, my validator has 44 million SUI staked, but only 14 million SUI counted in the vote" & then "the rest came from the Foundation." the chain agrees on the numbers: the alphafi validator had 43,940,955 SUI on may 28 & 44,230,477 on may 29. 44M minus 14M is the 30M from 0x341fa71e…. so by alphafi's own ceo, that wallet is the foundation's. it's still his word, not the foundation's, but it's the plainest attribution anyone has made. note the "my validator".

two more things about that validator. its wallet 0xa0920b07… got its very first transaction from cluster A: 0.5 SUI from w9c47 on 2024-08-31 (BZiPD3UL…), the same group that pulled its collateral five hours before the shutdown tweet (who moved early). & on day one, test stakes came from the fee wallet (10 SUI) & cluster-A wallets w9c47 & w7bff (1 SUI each). then, where its commission went. at its 8% rate the validator earned ~115,600 SUI of commission (worked out epoch by epoch from its pool's exchange rates; its 627 unstakes, feb 2025 to oct 11 2026, brought in 114,266 SUI after gas). ~82,700 SUI of that, about $181,800 at the price on each day it was paid, came off the foundation-labeled 30M alone. everything the wallet sent out, that commission plus whatever else came in, went to the operator set.

w9273, f71e & w3ce6 are behind most of the borrow-then-deposit pairs on the exits & the validator's wallet now holds six team position caps (the borrowed money). a validator that exists because of the 30M paid its income to the same wallets & straight into their kucoin account.

the other validator: alphafi's walrus node

walrus is sui's storage network, w its own staked token, WAL. alphafi ran a storage node there too, pool 0xc9f0d4ef… ( walrus.mainnet.alphafi.xyz), a launch node from walrus's first epoch, charging 60% commission.

• who runs it: 0xf71b5ff8…, which holds the node's cap & its governance rights. its first SUI came from alphafi's fee wallet: 5 SUI at 10:15:17 on mar 18 2025 (CgbLmjKp…) & 30 more at 10:15:57. one minute later, at 10:16:52, it registered the node (39xfbBkc…).
• its one payment out: on jan 31 2026 it sent 2 SUI to parent (HrNm619u…), cluster A's parent wallet, the one that funded a027 & got a027's leftover 152,897 ALPHA after the crash (who moved early). small, but it's a direct line from alphafi's node operator to cluster A.
• its stake: on mar 21 2025 0xf2182a9b… staked 4,170,000 WAL w it, part of one tx that spread 487.49M WAL across 52 launch nodes (BiEBYy2n…). that wallet got 500M WAL a month before walrus mainnet, so it looks like walrus's own launch delegation; nothing on chain says whose it is. on jul 15 2025 it withdrew the 4.17M (8W8K5eF8…). among the small launch-day stakers: 6a49, 10,000 WAL on mar 27-28 2025 (37VPLbKQ…), the wallet whose popkins nft stakes line up, to the minute, w raj's own posts about staking his.
• since then: the node dropped out of walrus's committee. its pool's latest_epoch is still walrus epoch 9 (~jul 2025), it holds 84,212 WAL & it isn't among the 94 nodes in the current committee (epoch 41). 2,187.87 WAL of commission sits there unclaimed.

raj pushed it at launch: "Stake those $WAL with AlphaFi validator :)"↗ (mar 4 2025). same shape as the sui side: a launch-size delegation from what looks like the network's own wallet, an operator set up w alphafi's money & the delegation gone months before the shutdown.

the rescue's USDC came out of coinbase

0x6095… isn't a mystery wallet: it's one of coinbase's sui hot wallets. customer deposit addresses sweep into it & into 0x2e4706e4…, which suivision labels "Coinbase Account", interchangeably & a deposit address only sweeps into its own exchange. 154,897 transactions since oct 2024, 50,248 recipients, money in = money out every month. that's a hot wallet's shape.

39.4M gross. 18,944,043 USDC reached the rescue: 8.4M straight to the bailout wallet & 10,544,043 through the relay to 0xf2f1…, which fed 0x5f81…'s sep 8 & 9 repayments. that's all the USDC the rescue repaid with. the other 20,455,957 went straight back into coinbase within minutes. the bailout's USDT, DEEP & xBTC were bought through w4eb8 w money withdrawn from kraken (next sections).

the relay e6c9 runs through

e6c9 0xe6c9fae4… & its partner 0x3e66fae5… never pay their own gas. a private gas wallet, 0x105e89e5…, co-signs every transaction they make. it isn't a shared gas station: 29 transactions in its whole life, for nine wallets. it was funded w 7.352 SUI by suivision's "Kraken Account" on 2026-02-04 at 21:02:55 (6jY2KC2u…), the same evening test deposits from a kraken account & a coinbase account arrived. the other seven wallets it signs for are deposit wallets that collect small payments (4 USDC to 56k, about $58k in all, from kraken, coinbase, binance & three private wallets) & sweep them into 0x3e66…, which banks them at coinbase through deposit addresses 0xf4b9411f…, 0x3e204456… & 0x7e2126fd…. a small payments or custody setup, w its own gas wallet, a coinbase account & a kraken account.

• aug 13 to 17: 0x3e66… tests 0x7e21… (7 & 55 USDC); kraken sends 0x7e21… 35 USDC, then 500,000 (3w1TVpYH…); coinbase pays e6c9 its first ever 5,000,000 USDC & e6c9 sends all of it into 0x7e21… two and a half minutes later (EbPB3vw9…).
• sep 7: 0xf2f1… is born at 15:58 (its first transaction, a 10 USDC kraken withdrawal). at 17:11:490x3e66… sends it a 50 USDC test (CKyaZXqk…). at 17:57 e6c9 pays it 4M (5aCBV77i…). at 20:08 coinbase pays 0x3e66… a round 7M & by 20:22 0xf2f1… has received exactly 10,544,043 (Cwi16VMX…) while the 455,957 change goes back into coinbase (AA7sgsgf…). 0x5f81… then repays 10,544,097, $54 more. someone knew the number to within a rounding error.
• sep 10 & 11: three more loops, 4M, 4M & 7M: coinbase to e6c9, e6c9 to 0x7e21…, swept back into coinbase, each inside nine minutes (2YXFs9Kc…, KjsU2dzF…, 2rWiB5eo…). if the withdrawing & depositing accounts were the same, that's pointless, so most likely there are two coinbase accounts on either side of e6c9. the chain can't say whose.
• sep 25 20:09:48, three hours before the shutdown tweet: kraken sends 1,140,000 USDC into 0x7e21…, swept into coinbase 42 seconds later (8UwokhFP…). same size as the 1,140,066 USDT w4eb8 bought for the bailout; nothing on chain connects the two.

kraken on both ends

0x03b6… is kraken's sui hot wallet: two kraken deposit addresses swept into suivision's labeled "Kraken Account" & then into 0x03b6…, taking their gas from each in turn. through it: every rescue-side wallet's first SUI (0x5f81…, the cap holder, was gassed by alphafi's fee wallet instead); w4eb8's 1,179,505 USDC & 4,651,505 DEEP, which bought the bailout's USDT & xBTC; the 1.5M SUI the bailout wallet got on sep 23, didn't use & sent back through w4eb8 into kraken deposit address 0x65ffd672… on sep 29; & the security package's SUI & WAL, sent into three more kraken deposit addresses (its ETH went into what etherscan labels "Kraken: Hot Wallet 2"). every kraken deposit address the rescue side used was fresh & used once, so none of them ties the rescue to any other kraken customer.

the foundation-labeled side uses the same two exchanges

0x51f8fb27… is an operations wallet the delegation wallet has fed 68.6M SUI since march 2025 (it pays the same recipients every two weeks). 0x37f187e1… is a deepbook trading wallet in that network's orbit: its first funder, 0xc47fbfc4…, also paid 0x341fa71e's gas, 0x51f8 tops it up w SUI & the hub 0x3bd2949d… sent it 100k SUI. both take USDC out of coinbase:

& kraken: 0x341fa71e…'s own gas has come from suivision's "Kraken Account" (dec 2025 to feb 2026) & then from 0x03b6… (mar to sep 9 2026) & 0x03b6… paid about 2.77M SUI into 0xc6ffe6fc…, the network's deposit address at the 0x3bd2… hub, from sep 21.

what doesn't exist: a transfer between the two sides, a deposit address both used, or a gas wallet both used. the rescue side's kraken withdrawals are round test-then-real amounts that don't fingerprint an account. coinbase & kraken are the two biggest US exchanges. both sides using them fits the foundation paying through its own exchange accounts & fits almost anyone else just as well.

the network also paid alphafi, every two weeks

one kind of transfer between the foundation-labeled side & alphafi does exist & it isn't the rescue. since jul 2023, 0x341fa71e… & then 0x51f8… have paid SUI in batches every two weeks, over half of it to protocols' reward wallets (navi, suilend, scallop & more). alphafi was on the list from may 2025 to sep 11 2026: 740,440 SUI to 0x6160b95f…, then 2,221,825 SUI to the lending admin in 22 batches.

it reached alphalend's reward pools: each payment went to a team wallet that minted stSUI w it & sent the stSUI back within minutes & the lending admin put 2,832,349 stSUI into alphalend rewards. the whole program, back to its first batch & every wallet it pays: every two weeks since 2023.

who collected it: team-linked wallets claimed 37% of the stSUI rewards. the same lending admin also paid out 59M IKA that traces back to IKA's own genesis supply, not the foundation; team-linked wallets claimed 18% of it, after 13.86M took a detour through w9273 & mostly came back in daily slices from team wallets. net, about 11.4M IKA (~19%) ended up w team-linked wallets (the IKA detour).

some of it went to the bad debt itself. alphafi's fee wallet held the caps of all four bad-debt positions from december 2025 (september) & it claimed their stSUI rewards: 205,790 stSUI on P4 in 24 claims (2025-12-07 to 2026-09-05), 23,877 on P2 (mar 29 to sep 4 2026) & 15,819 on P3 (sep 5), about 245k in all, out of the same reward pools the program's SUI went into. the last claims came two days before the caps went to 0x5f81….

the public record

• @SuiFoundation, sep 23 2024↗: it "selected Coinbase Prime to offer custody and treasury management services", w the community treasury custodied w bitgo & coinbase. so the foundation banks at coinbase, by its own account. whose coinbase account paid the rescue is not something anyone outside coinbase can see.
• mysten's own wallet, slush, ran its SUI, WAL, DEEP & USDC strategies through alphafi (slush on sep 25↗).
• sui's hashi launch post quoted raj as a partner; alphafi was announced as a diamond sponsor of sui basecamp 2026 around sep 3. sui.io/basecamp no longer lists alphafi (checked oct 4).
• the 2024 precedent: when an analyst traced big SUI sales to this same wallet network, sui's reply↗ said the seller was likely an infrastructure partner. it didn't address 0x341fa71e….
• alphafi: no post since the shutdown thread. raj: one reply on sep 26 w a withdrawals update that sends people to discord (the code), where general chat is gone & the one channel left open has a member's oct 1 "it’s time for answers" to raj, unanswered (screenshots).

what the foundation knew & when

by sui's own account, its security team identified alphafi's "misconfiguration of their ALPHA oracle" & the bad debt it created & helped resolve it & the foundation chose to cover it (@SuiNetwork, sep 25 23:15:51↗ (archived)). alphafi says it's supporting the foundation's investigation w records & technical assistance (@AlphaFiSUI↗ (archived)). the chain dates the rescue well before either post:

• sep 7, 17:00 to 17:27: alphafi's fee wallet gasses a brand-new wallet (0x5f81…) & moves all four bad-debt position caps into it (P1 P2). 0x5f81… still holds them. who controls it isn't on chain, but from the next afternoon (sep 8, 16:33) the rescue money flowed into it (below), so the plan existed by then, 18 days before anyone said a word.
• sep 8 & 9: 0xf2f1…, a fresh wallet funded out of coinbase, passes 10.54M USDC to 0x5f81…, which repays it on P4 & P2 (above).
• sep 11: the foundation-labeled 0x51f8… still pays alphafi's lending admin its biweekly 104,664 SUI (F4mzvDrF…; every two weeks since 2023).
• sep 20: $17,129,783 repaid in one transaction (FK6jAgAP…).
• sep 25: the next 0x51f8… batch leaves alphafi out (21:39, 3UtdLMML…). 90 minutes later alphafi announces the shutdown & sui posts six minutes after that.
• oct 6: 0x341fa71e… withdraws its 30M from alphafi's validator, 29 days after the caps changed hands & 11 days after the announcement (above). until then alphafi's validator kept earning on it & its commission went to the operator wallets.
• oct 11 & 12: alphafi's validator asks to leave (FhjhfWAC…) & is out of the active set at the oct 12 epoch change. its last 14,682 SUI goes to 0x862d2bfd… 2.5 hours later (above).
• since: nothing. as of oct 19 2026 i can find no further statement from the foundation or @SuiNetwork on alphafi: no amount, no word on whose money paid, no result from the investigation.