Thodex CEO Flees Collapse

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Thodex

While the Thodex matter is still ongoing, it would appear that the vast majority of people involved have been released at this point. There is also no suggestion that others conspired to assist him in leaving the country with user funds. There is suggestion that Thodex was already in a challenging position, and may have in fact been operating fractionally for some time, and the timing of the closure aligns strongly with a regulatory crackdown that sought to ban cryptocurrency usage as a means of payment in the country.

The impression left is of a vulnerable platform, and of a desperate CEO forced through lack of alternatives to flee. There was no visibility or oversight into the backing of funds, and at least 643 bitcoin sat in a single "hot" wallet, without any indication of multi-sig being set up.

This exchange or platform is based in Turkey, or the incident targeted people primarily in Turkey.

About Thodex

Thodex operated since 2017 and had about 700,000 clients in Turkey. Exchange trading volumes were reportedly in the billions of dollars.

"Thodex was part of the cryptocurrency boom that has drawn in legions of Turks seeking to protect their savings from rampant inflation and an unstable currency. Inflation hit 16.2% in March, more than three times the central bank’s target of 5%. The Turkish lira has weakened 10% against the dollar this year, its ninth consecutive year of losses." "A survey by the World Economic Forum published in February found that 16 percent of Turks said they used or owned cryptocurrency – level pegging with Peru which, along with Turkey, ranked fourth globally after Nigeria, Vietnam and the Philippines, where the currencies are used for overseas remittances." "Thodex announced on its website that it would be unavailable for several days to handle a sales process. The vague message didn’t reveal details such as when it would be back and if the users’ funds were safe, prompting investors to start voicing their frustration." "Trading at the platform stopped and investors started to contact the authorities. Complaints against the crypto exchange skyrocketed by more than 1,160% compared to the previous week." "Thodex clients and investors were left with unanswered questions about when they would be able to recover their money." "In a statement, the exchange claimed that it had found an ‘abnormality’ in its accounts and that it shut down the exchange to investigate this."

This exchange or platform is based in Turkey, or the incident targeted people primarily in Turkey.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Thodex CEO Flees Collapse

Date	Event	Description
April 1st, 2021 10:56:00 AM MDT	Turkey Demands User Information	Turkish authorities start to request user information from different cryptocurrency exchanges throughout the country, stating this is to help tackle financial crimes in the country.
April 16th, 2021 2:42:00 AM MDT	Turkey Bans Cryptocurrencies	Turkey's central bank releases new regulation which bans the use of cryptocurrency assets for payments. Reports widely surface about this. The ban goes into effect on April 30th, 2021.
April 16th, 2021	Doge Exchange Rate Mismatch	Between April 14th and April 16th, the market price of Dogecoin increased from $0.11 USD to $0.42 USD on global exchanges, however it stayed priced at the low price of $0.11 USD on Thodex.
April 17th, 2021 12:41:36 PM MDT	Last Recorded Withdrawal	The last time that a withdrawal is recorded from the Thodex hot wallet, according to CoinDesk.
April 21st, 2021	Thodex Suspends Operations	Thodex posts a notice on their website explaining that they have suspended operations due to a partnership offer. The service promised that it would remain shut for only 5 days.
April 21st, 2021	Ozer Flees Turkey	Thodex CEO and founder Faruk Fatih Ozer reportedly leaves from Istanbul on a commercial flight. This was described as being to meet with "foreign investors".
April 21st, 2021 7:18:00 AM MDT	Bloomberg Thodex Article	Bloomberg publishes an article on the situation. This reportedly stated that
April 21st, 2021 8:08:00 MDT	Loss Amount Questioned	Questions around the total amount of the platform are raised on Twitter.
April 22nd, 2021 8:45:00 AM MDT	Fraud Complaint Filed	Users of the Thodex platform reportedly filed a fraud complaint. Some Thodex employees are detained.
April 23rd, 2021 2:10:00 AM MDT	Bloomberg Reports Manhunt	Bloomberg reports that the Justice Ministry has issued a red notice for Faruk Fatih Ozer and described the situation as a manhunt.
April 23rd, 2021 3:14:00 AM MDT	Daily Sabah Article Published	Daily Sabah article published. (Review and expand.)
April 24th, 2021 7:16:29 PM MDT	Anadolu Agency Article	An article is published by Anadolu Agency. (Review and expand.)
April 26th, 2021 1:24:41 AM MDT	ZDNet Article	The Thodex situation is published on ZDNet. This article reports that the founder has fled the country with "billions of dollars in user assets", "approximately $2 billion in funds with him which belongs to 391,000 investors". It's reported "thousands of Turkish citizens have now filed criminal complaints" and the Justice Ministry has issued a red notice for Ozer. The Thodex website is apparently calling the situation a "baseless" "smear campaign", that they temporarily closed to resolve an "abnormality" in the company accounts, and that Ozer left Turkey to meet with "foreign investors". The Thodex website also claims there was an undisclosed cyber-attack causing a "suspicious situation", that the company is "prevented from continuing its commercial life" as "a result of the perception of victimization created in the public [space]", and that Ozer will be returning to Turkey to cooperate with authorities. Ozer's original Twitter account was closed down and a new account is sharing company statements. (Need to add more/investigate on the Twitter accounts.)
April 30th, 2021 4:57:27 AM MDT	CoinTelegraph Report	CoinTelegraph reports an update. This article reports that a red notice has been issued for Özer, 6 have been jailed and 83 others have been detained in the case, and information about Özer's siblings as supected. The company's portfolio is reported as totaling $108m, referencing reports from interior minister Soylu.
May 3rd, 2021 7:48:00 AM MDT	BeInCrypto Article	BeInCrypto publishes an article on the exchange. The article is also published through Yahoo Finance.
May 31st, 2021 9:34:32 AM MDT	Hot Wallet Transfer 1	There is a further transfer of 0.04953400 BTC from the Thodex hot wallet.
June 14th, 2021 8:22:16 AM MDT	Hot Wallet Transfer 2	There is a further transfer of 1.03800000 BTC from the Thodex hot wallet.
June 14th, 2021 11:51:57 AM MDT	Hot Wallet Transfer 3	There is a further transfer of 1.22000000 BTC from the Thodex hot wallet.
June 16th, 2021 12:58:36 AM MDT	Hot Wallet Transfer 4	There is a further transfer of 1.84491331 BTC from the Thodex hot wallet.
June 15th, 2021 1:25:15 AM MDT	Hot Wallet Transfer 5	There is a further transfer of 1.88270733 BTC from the Thodex hot wallet.
March 31st, 2022 9:58AM MDT	Prison Set At 40,564 Years	There are reports that he may face 40,564 years in prison. Bloomberg publishes a popular article on the proposed sentence by a Turkish prosecutor. "The indictment on Istanbul-based Thodex seeks sentences of up to 40,564 years for each of the 21 defendants."
August 30th, 2022	Arrest In Albania	Faruk Fatih Özer was arrested by authorities in the city of Vlora, Albania, confirmed by biometric results. Laptops, mobile phones, and bank cards were also seized.

Total Amount Lost

Different totals have been floated at various times:

	BeInCrypto	ZDNet
Date	April 22nd	April 26th
Users	390,000	391,000
Losses	"hundreds of millions"	"$2 billion"

The total amount lost has been estimated at $2,000,000,000 USD, though this amount is questioned.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

"Rumors have since been rife that Thodex owner Faruk Fatih Ozer has fled the country with the intent of defrauding users of their estimated $2 billion total in crypto." "Has the CEO of the Thodex cryptocurrency exchange in Turkey exit-scammed, fleeing the country with $2 billion worth of his customers' assets?" "Thodex stopped trading on April 22, coinciding with the disappearance of its chief executive officer (CEO) Faruk Fatih Özer, who is reported to have fled to Thailand with more than US$2 billion." "Özer also closed all his social media accounts, and the customer service line of the Turkish exchange is said to have been disconnected." "Users and media reports had claimed Ozer could have run off with $2 billion but Soylu said the company’s portfolio totaled $108 million."

"Turkish security officials then released a photo of the Thodex founder going through passport control at Istanbul Airport on his way to an undisclosed location. Security sources cited by Turkish broadcaster HaberTürk said earlier he was in Albania’s Tiran." "Police raided the company's headquarters on the Asian side of Istanbul and seized computers and digital materials, press reports revealed." "Turkish police ... detained 62 people as they continue to investigate into the cryptocurrency trading platform Thodex, which is accused of defrauding investors after thousands of users filed criminal complaints saying they had been scammed." "Local authorities detained over 83 individuals suspected to be involved in the case amid growing concerns that Thodex was a scam after the platform halted money withdrawals." "The suspects were apprehended in raids carried out in eight cities including Istanbul, AA reported on Friday."

"Before fleeing Turkey, Ozer reportedly contemplated suicide or giving himself up to the authorities." “I was born as one of the three siblings of a civil servant,” Ozer said in his statement, adding that he’s a high-school dropout. As the company ran into financial trouble, he said he thought about either committing suicide or giving himself up to authorities, but both of those options meant clients’ assets would never be retrieved. “So I decided to stay alive and fight, work and repay my debts to you. The day I repay all my debt, I will return to my country and give myself in to justice.” "Thodex added that a previously undisclosed "cyberattack" impacted roughly 30,000 users causing a "suspicious situation."" "[I]t’s still impossible to say conclusively that this situation is an exit scam. The exchange has gradually been reducing the volume of outgoing transactions since October 2020. The only time the exchange had an increase in the outgoing transaction volume was in March of this year."

"The Turkish Central Bank has recently announced a ban on cryptocurrency payments in the country." "Turkey's central bank says the payment restrictions are necessary due to a lack of a regulatory, "central" authority." "From 30 April, residents in Turkey will be unable to legally pay for goods and services with digital assets." "The Turkish crypto market remains unregulated despite growing scepticism from President Recep Tayyip Erdogan's government about its safety." "In light of the fallout, the Turkish government moved to enforce stricter regulations on cryptocurrency exchanges." "Several government offices are involved in drafting the regulatory framework, including the financial crimes watchdog Masak, the Treasury & Finance Ministry as well as the Capital Markets Board. They expect a draft to be completed within a few weeks." "Orkun Godek, an investment researcher based in the capital Istanbul, remarked, “This market looks like a bottomless pit and regulation is absolutely needed. Risks may trigger new risks. People may close positions elsewhere to counter their crypto losses.”" "Meanwhile, hundreds of thousands of Turks are left gazing at the ruins of their savings and retirement plans, wondering if they will ever recover."

Arrests of Siblings

Özer's brother and sister were considered important suspects in the case since both had significant cryptocurrency holdings.

His brother Güven Özer was reported to hold $2.7m USD worth of digital assets on the platforms BTC Turk and Paribu. Güven reportedly served as an active executive at Thodex despite not having an official role at the company.

His sister Serap Özer was reported to have $14.6m USD worth of transactions on her Binance account between 2018 and 2021. She is alleged to have overseen the financial activities at Thodex, however she insists that the account is not hers.

Red Notice Issued

Interpol released a red notice for the Thodex CEO and founder.

Interior minister Süleyman Soylu expressed hope and optimism that he would be returned successfully.

“When he is caught with the red notice, we have extradition agreements with a large part of these countries. God willing he will be caught and he will be returned.”

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

CEO Faruk Fatih Özer was ultimately arrested on August 30th, 2022, from his location in Vlora, Albania.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

Thodex violated all three principles of fund safety. Funds were stored online, funds were accessible to one person (the CEO), and the platform continued to operate without a full backing of customer assets. Any level of regulation would have easily prevented what happened.

Our specific framework proposes additional training which would have provided Ozer and associates with additional knowledge about the safety of fund storage, mandated that all funds be stored in a multi-signature wallet which would prevent any one person from taking the funds, and prevented the specific fleeing of the majority of fund holders. In addition, platform backing is subject to periodic review, made available to all users of the platform, and include a proof that all customers are included. A comprehensive collective insurance fund exists to cover any shortfalls and assist long before the platform were to collapse.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.