Thodex CEO Flees Collapse

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Thodex Logo/Banner

Thodex was a large cryptocurrency exchange based in Turkey, which operated since 2017. Shortly after Turkey started requesting more information from users of cryptocurrency exchange platforms, then banned the use of cryptocurrencies for payments in the country, the platform shut down and it's CEO fled to Albania. There were widespread reports that $2b in assets were lost as a result, however the interior minister reported that the figure was closer to $108m. The CEO was ultimately arrested an entire year later. It is unclear what portion of funds have been returned to users.

About Thodex

Thodex operated since 2017 and had approximately 700,000 clients in Turkey. Exchange trading volumes were reportedly in the billions of dollars.

Background Situation In Turkey

Thodex was part of a cryptocurrency fervor sweeping Turkey and drawing in large numbers of Turks seeking to protect their savings from inflation and currency instability. The inflation rate in Turkey hit 16.2% in March 2021, which was more than three times the central bank target of 5%. The Turkish lira had weakened 10% against the US dollar in the ninth consecutive year of losses. In a survey conducted by the World Economic Forum and published in February 2021, it was revealed that 16 percent of Turks reported using or possessing cryptocurrency. This figure was on par with Peru, placing both countries fourth globally, alongside Nigeria, Vietnam, and the Philippines. Notably, these nations are recognized for utilizing cryptocurrencies in facilitating overseas remittances.

Summarize and cite TBD

These incidents prompted Turkey's financial watchdogs to introduce stricter regulations, including banning cryptocurrency payments and subjecting exchanges to anti-money laundering rules. Yet, for many victims, these measures arrived too late, exacerbating their struggles to find secure investment avenues.

Now, disillusioned by the collapse of exchanges and facing financial ruin, some investors vow never to return to cryptocurrencies, while others remain enticed by the allure of potential profits despite the risks. Meanwhile, lawyers representing victims express concern over the dire consequences, including suicides, and emphasize the devastating impact on low and middle-income individuals who invested their savings, hoping for financial stability. Amidst the ruins of shattered dreams and depleted savings, many Turks are left grappling with uncertainty, questioning if they will ever regain what they lost.

The Reality

Thodex had likely been operating fractionally for a long time prior to their collapse.

An arguably lax oversight and taxation previously allowed for rampant crypto adoption, with a significant portion of the population utilizing or owning cryptocurrencies without fully understanding the risks.

Ban Against Cryptocurrency Payments

In mid-April, Turkey decreed that the use of cryptocurrencies for payments was no longer allowed.

What Happened

The Thodex platform, at the time one of Turkey's largest exchanges, stopped processing withdrawals, preventing users from having any access to their stored funds which were entrusted to the platform.

Key Event Timeline - Thodex CEO Flees Collapse

Date	Event	Description
April 1st, 2021 10:56:00 AM MDT	Turkey Demands User Information	Turkish authorities start to request user information from different cryptocurrency exchanges throughout the country, stating this is to help tackle financial crimes in the country.
April 16th, 2021 2:42:00 AM MDT	Turkey Bans Cryptocurrencies	Turkey's central bank releases new regulation which announce a ban on the use of cryptocurrency assets for payments. Reports widely surface about this in BeInCrypto and local Turkish newspaper Alarabiya News. The ban officially goes into effect on April 30th, 2021.
April 16th, 2021	Doge Exchange Rate Mismatch	Between April 14th and April 16th, the market price of Dogecoin increased from $0.11 USD to $0.42 USD on global exchanges, however it stayed priced at the low price of $0.11 USD on Thodex.
April 17th, 2021 12:41:36 PM MDT	Last Recorded Withdrawal	The last time that a withdrawal is recorded from the Thodex hot wallet, according to CoinDesk.
April 20th, 2021 11:00:00 AM MDT	CoinMarketCap Data Stops	A "CoinMarketCap spokesperson tells CoinDesk that the exchange stopped providing trading data around 1 p.m. EDT on Tuesday."
April 21st, 2021	Thodex Suspends Operations	Thodex posts a notice on their website explaining that they have suspended operations due to a partnership offer. The service promised that it would remain shut for only 5 days.
April 21st, 2021	Ozer Flees Turkey	Thodex CEO and founder Faruk Fatih Ozer reportedly leaves from Istanbul, Turkey to Tirana, the capital of Albania, on a commercial flight. This was described as being to meet with "foreign investors".
April 21st, 2021 7:18:00 AM MDT	Bloomberg Thodex Article	Bloomberg publishes an article on the situation. "Turkish cryptocurrency exchange Thodex abruptly halted trading on Wednesday citing an unspecified partnership transaction, spurring complaints from users who can’t access their digital assets."
April 21st, 2021 8:08:00 MDT	Loss Amount Questioned	Questions around the total amount of the platform are raised on Twitter.
April 22nd, 2021 3:39:00 AM MDT	Bloomberg Reports Thodex Goes Bust	Bloomberg publishes another article. "One of Turkey’s largest cryptocurrency exchanges said it lacked the financial strength to continue operations, leaving hundreds of thousands of investors fearing their savings have evaporated as authorities sought to locate the company’s 27-year-old founder, who fled the country".
April 22nd, 2021 6:49:00 AM MDT	Ozer Defends Himself On Twitter	Ozer posts a three-page statement in Turkish on Twitter in an attempt to defend himself, calling the accusations "baseless". "I would like it to be known that; As I have never done anything in my life that would harm neither my state nor my nation, I consider it cruel to even attribute such a thought to me."
April 22nd, 2021 8:45:00 AM MDT	Fraud Complaint Filed	Users of the Thodex platform reportedly filed a fraud complaint. Some Thodex employees are detained.
April 22nd, 2021 10:46:10 AM MDT	Deutsche Welle Article	Deutsche Welle reports that Turkish authorities are investigating Fatih Faruk Ozer, the founder of Thodex cryptocurrency platform, who is suspected of fraud and founding a criminal organization. Thodex abruptly went offline, prompting thousands of complaints from investors unable to access their funds. Ozer is believed to have fled the country with as much as $2 billion in investors' assets. The company denies wrongdoing, claiming to be in talks for a significant investment deal. This incident underscores concerns in Turkey about the risks associated with cryptocurrencies, leading the central bank to tighten regulations and ban the use of digital currencies for payments starting from April 30.
April 22nd, 2021	Demiroren News Agency Releases CCTV Footage	Demiroren News Agency reportedly released CCTV footage. TBD find more about that release.
April 23rd, 2021 2:10:00 AM MDT	Bloomberg Reports Manhunt	Bloomberg reports that the Justice Ministry has issued a red notice for Faruk Fatih Ozer and described the situation as a manhunt.
April 23rd, 2021 3:14:00 AM MDT	Daily Sabah Article Published	Daily Sabah reports that Turkey has escalated its pursuit of Faruk Fatih Özer, the founder of Thodex cryptocurrency platform, issuing an international arrest warrant and detaining 62 individuals linked to the company amid allegations of a $2 billion scam. Özer is believed to have fled to Albania, triggering Interpol's involvement. Turkish authorities have seized his assets and initiated legal proceedings for his extradition. Thodex, which abruptly halted trading citing a sale process, faces investigations and mounting complaints from users unable to access their funds. The incident has sparked public outcry and intensified scrutiny over cryptocurrency regulations in Turkey, with the central bank recently banning crypto payments due to perceived risks.
April 23rd, 2021 4:34:58 AM MDT	TRT World Article Published	TRT World publishes an article on the Thodex exchange collapse. TBD fill in more details. Check history of modifications.
April 23rd, 2021 6:56:09 AM MDT	Bank Info Security Article Published	Bank Info Security publishes an article about the Thodex situation. TBD fill in more details.
April 24th, 2021 7:16:29 PM MDT	Anadolu Agency Article	An article is published by Anadolu Agency. (Review and expand.)
April 26th, 2021 1:24:41 AM MDT	ZDNet Article	The Thodex situation is published on ZDNet. This article reports that the founder has fled the country with "billions of dollars in user assets", "approximately $2 billion in funds with him which belongs to 391,000 investors". It's reported "thousands of Turkish citizens have now filed criminal complaints" and the Justice Ministry has issued a red notice for Ozer. The Thodex website is apparently calling the situation a "baseless" "smear campaign", that they temporarily closed to resolve an "abnormality" in the company accounts, and that Ozer left Turkey to meet with "foreign investors". The Thodex website also claims there was an undisclosed cyber-attack causing a "suspicious situation", that the company is "prevented from continuing its commercial life" as "a result of the perception of victimization created in the public [space]", and that Ozer will be returning to Turkey to cooperate with authorities. Ozer's original Twitter account was closed down and a new account is sharing company statements. (Need to add more/investigate on the Twitter accounts.)
April 29th, 2021 5:11:08 AM MDT	CoinGeek Article Published	CoinGeek publishes an article covering the situation. TBD fill in details.
April 30th, 2021 4:57:27 AM MDT	CoinTelegraph Report	CoinTelegraph reports an update. This article reports that a red notice has been issued for Özer, 6 have been jailed and 83 others have been detained in the case, and information about Özer's siblings as supected. The company's portfolio is reported as totaling $108m, referencing reports from interior minister Soylu.
April 30th, 2021 8:48:00 AM MDT	Alarabiya Article Published	Alarabiya reports on the Thodex exchange collapse. TBD fill in more details of this article.
May 3rd, 2021 12:14:09 AM MDT	Forkast Article Published	Forkast publishes an article on the Thodex collapse. TBD fill in more details.
May 3rd, 2021 7:48:00 AM MDT	BeInCrypto Article	BeInCrypto publishes an article on the exchange. The article is also published through Yahoo Finance.
May 5th, 2021 10:52:02 AM MDT	Al Jazeera Article	News of the Thodex collapse reaches Al Jazeera with a full article including an interview with one of the victims. TBD add more details, summary.
May 31st, 2021 9:34:32 AM MDT	Hot Wallet Transfer 1	There is a further transfer of 0.04953400 BTC from the Thodex hot wallet.
June 14th, 2021 8:22:16 AM MDT	Hot Wallet Transfer 2	There is a further transfer of 1.03800000 BTC from the Thodex hot wallet.
June 14th, 2021 11:51:57 AM MDT	Hot Wallet Transfer 3	There is a further transfer of 1.22000000 BTC from the Thodex hot wallet.
June 16th, 2021 12:58:36 AM MDT	Hot Wallet Transfer 4	There is a further transfer of 1.84491331 BTC from the Thodex hot wallet.
June 15th, 2021 1:25:15 AM MDT	Hot Wallet Transfer 5	There is a further transfer of 1.88270733 BTC from the Thodex hot wallet.
March 31st, 2022 9:58AM MDT	Prison Set At 40,564 Years	There are reports that he may face 40,564 years in prison. Bloomberg publishes a popular article on the proposed sentence by a Turkish prosecutor. "The indictment on Istanbul-based Thodex seeks sentences of up to 40,564 years for each of the 21 defendants."
August 30th, 2022 6:21:44 AM MDT	CoinMarketCap Alexandria Article	An article about arrest appears online in CoinMarketCap Alexandria. TBD add summary of article.
August 30th, 2022	Arrest In Albania	Faruk Fatih Özer was arrested by authorities in the city of Vlora, Albania, confirmed by biometric results. Laptops, mobile phones, and bank cards were also seized.
September 6th, 2022 12:15:51 AM MDT	CoinMarketCap Alexandria Article	The CoinMarketCap Alexandria article is update. TBD investigate update.
April 20th, 2023 1:59:00 AM MDT	Video Of Extradition	A video on YouTube is published showing Faruk Fatih Özer, the founder of the cryptocurrency exchange Thodex, being extradited to Turkey from Albania. Upon arrival at Istanbul Airport, he will undergo a health check before being taken to the Istanbul Police Department Airport Branch for further processing, including giving a statement. Özer's extradition was approved by the Albanian Supreme Court following Turkey's formal request. Özer is implicated in a case involving charges of fraud, founding a criminal organization, and money laundering related to the disappearance of millions of dollars worth of cryptocurrency belonging to thousands of investors. He was apprehended in Albania after Turkish authorities sought his extradition, which was initially denied by local courts but later approved by the Albanian Supreme Court.

Technical Details

Limited information is available about what happened behind the scenes in Thodex. What appears clear is that there is a significant discrepancy between the assets held by the platform and the assets owed to investors.

One possibility is that Faruk Fatih Özer had an intense desire to continue operating the platform, even if it meant misleading platform users in the moment, so that he could ultimately repay investors.

“So I decided to stay alive and fight, work and repay my debts to you. The day I repay all my debt, I will return to my country and give myself in to justice.”

The other possibility is that Faruk Fatih Özer simply hoped to buy more time to escape from justice by whatever means possible.

Total Amount Lost

Different totals have been reported lost at various times.

Different Sources Reporting Different Losses on Thodex Exchange

Source	Date	Users	Loss Amount	Quote
BeInCrypto	April 22nd, 2021	"390,000"	"hundreds of millions"
SlowMist	April 22nd, 2021	-	"$24 million to $2.5 billion"
Deutsche Welle	April 22nd, 2021	"400,000" "391,000"	"$2 billion (€1.7 billion)"	"Thodex after its founder shut down its site and reportedly fled the country with as much as $2 billion (€1.7 billion) in investors' assets" "400,000 members, of whom 391,000 are active in trading"
TRT World	April 23rd, 2021	"391,000"	"at least $2 billion"	"its founder fled with a reported $2 billion in investors' assets" "the exchange shut down while holding at least $2 billion from 391,000 investors"
Bank Info Security	April 23rd, 2021	"390,000"	"$2 billion"	"Accused of Fleeing to Albania With $2 Billion in Funds", "fleeing the country with $2 billion worth of his customers' assets", "disappearing with up to $2 billion in assets" "Thodex has about 390,000 active users"
Daily Sabah	April 23rd, 2021	"390,000"	"$2 billion"	"An estimated $2 billion worth of investments are said to be affected and a lawyer for the victims said the money invested by about 390,000 active users had become “irretrievable.”"
ZDNet	April 26th, 2021	"391,000"	"$2 billion"
CoinGeek	April 29th, 2021	"close to 400,000"	"$2 billion"	"an exchange suspected of taking $2 billion from close to 400,000 investors"
CoinTelegraph	April 30th, 2021	-	"totaled $108 million"	"As previously reported, the missing Thodex CEO is reported to have run off with as much as $2 billion worth of crypto, but according to the latest reports, interior minister Soylu said that the company’s portfolio totaled $108 million."
Alarabiya	April 30th, 2021	-	"$2 billion", "$108 million"	"Users and media reports had claimed Ozer could have run off with $2 billion but Soylu said the company’s portfolio totaled $108 million."
Forkast	May 3rd, 2021	-	"more than US$2 billion"	"Faruk Fatih Özer, who is reported to have fled to Thailand with more than US$2 billion"
Al Jazeera	May 5th, 2021	"400,000"	"$2bn"	"Thodex’s CEO, who reportedly fled to Albania with $2bn belonging to some 400,000 clients"
NTV News	Apr 20th, 2023	"400,000"	"tens of millions of dollars"	"Fatih Özer'in 400.000 kişiye ait onlarca dolar değerindeki Kripto parayla yurt dışına kaçtığı belirtilmişti." "It was stated that Fatih Özer fled abroad with tens of millions of dollars' worth of cryptocurrency belonging to 400,000 people."

The total amount lost has been estimated at $2,000,000,000 USD, though this amount is questioned. TBD need to resolve how much was actually lost.

Immediate Reactions

Thodex, which halted trading and fled with $2 billion belonging to clients, drove some investors, like 65-year-old pensioner Hulya Ozkal, to contemplate drastic measures due to their financial losses.

"Thodex announced on its website that it would be unavailable for several days to handle a sales process. The vague message didn’t reveal details such as when it would be back and if the users’ funds were safe, prompting investors to start voicing their frustration."

"Trading at the platform stopped and investors started to contact the authorities. Complaints against the crypto exchange skyrocketed by more than 1,160% compared to the previous week."

"Thodex clients and investors were left with unanswered questions about when they would be able to recover their money." "In a statement, the exchange claimed that it had found an ‘abnormality’ in its accounts and that it shut down the exchange to investigate this."

Twitter Statement And Reactions

Shortly after fleeing Turkey, owner Faruk Fatih Ozer took to Twitter with a three page statement. The text is in Turkish and formatted as an image, so it is only readable in English through the use of OCR and translators combined.

Dear users of Thodex,

1/3

There has been a need to inform the public and the dear users who use our Thodex Platform regarding the process we have been through.

First of all I want to indicate; my company Koineks Teknolojileri A.Ş. and most of the claims made about the Thodex platform it owns are baseless.

Thodex platform, where nearly 700,000 users are trading, has not victimized anyone so far and will not do so from now on. 25.000.000.00-TL, which occurred as a result of the cyber attack against our company in 2018. Without reflecting the damage to any of our users, our company tolerated it with its own means and made a serious infrastructure system change in order not to experience a cyber attack again.

Considering both the financial structure of the company and the number of users in the process, it attracted the attention of many domestic and foreign investors, and received very serious partnership offers at the international level. During the partnership negotiations, which have been going on for about 3 months, when the financial and digital data are examined together, it has been determined that there is an abnormal fluctuation in the company accounts as of last week. Thodex Platform has been temporarily closed to determine the reasons and sources of this.

While the company's technical team was doing this research, I personally went abroad on 19.04.2021 to make final negotiations with the foreign investor.

2/3

In the examination made on the company accounts, it was determined that the cyber attack event continued and the correct data of some account holders could not be reached.

The allegations that were made public on April 22, 2021 that I disappeared after causing a loss of approximately 2 billion USD to approximately 391,000 people are unfounded. In order to respond urgently to these claims that go beyond the limits of fairness and understanding, I have had to make this statement.

Firstly; According to our initial findings, only about 30,000 of our nearly 700,000 users have a suspicious situation, and the bank login fees of these people are available in their company accounts on the platform. In this respect; First of all, I announce to the public that no user will be victimized.

MOREOVER; IT CAN BE PERCEIVED BY SOME PEOPLE BY INTRODUCING THEIRSELF AS SPECIALISTS, IN SOCIAL MEDIA AND THROUGH THE PRESS, THE PUBLIC CAN MAKE A PERCEPTION LIKE 2 BILLION USD, WITH AN AMOUNT THAT DOESN'T CONSIDER WITH MIND, LOGIC AND ACCOUNT. FOR; LEAVE THE TRADING VOLUME OF THODEX THE TRADING VOLUME OF ALL CRYPTO PLATFORMS IN TURKEY IS NOT AT THIS LEVEL.

3/3

Thus; The records of our company were previously submitted to the information of institutions such as MASAK, CMB, Ministry of Treasury and Finance, and it is also confirmed by the records of the relevant institutions that there is no irregularity.

This process has turned into a slander campaign with inaccurate and exaggerated statements, causing harm to both users and myself. For; According to our findings, payments of around 30,000 users will be made after their accounts are cleared. While our company, with a market value of approximately 40 million USD as of today, can continue its commercial life, it is tried to prevent our company from continuing its commercial life as a result of the perception of victimization created by the public.

What I would like to ask dear users is that the statements not made by our company should not be respected. I personally declare that by returning to Turkey in a few days, I will ensure that the truth is revealed in cooperation with the judicial authorities and I will do my best to prevent the victimization of users. I would like it to be known that; As I have never done anything in my life that would harm neither my state nor my nation, I consider it cruel to even attribute such a thought to me.

In this way; I respectfully submit to the public's knowledge that the smear campaign against both myself and my company should not be respected.

Faruk Fatih Ozer

THODEX

The top comment on Twitter appears to express support for Faruk, however requests him not to run away. Other comments expressed to join rival exchange Binance and that the $2 billion figure was entirely fabricated as part of an attack on cryptocurrency.

I wish you had said this at first, Faruk, it is difficult to gain trust, it is easy to lose, there is nothing to do anyway, we are waiting for you, save your honor, there is someone who trusts you and invests everything in you, I don't know how you should clean this stain that does not suit your cement, but you will not get anywhere by running away

Create a free Binance account... And have peace of mind with your money..

Funds are not #SAFU this time We are waiting for photos like budgies from wherever you go. They just made up $2 billion to screw up the crypto thing.

"Rumors have since been rife that Thodex owner Faruk Fatih Ozer has fled the country with the intent of defrauding users of their estimated $2 billion total in crypto." "Has the CEO of the Thodex cryptocurrency exchange in Turkey exit-scammed, fleeing the country with $2 billion worth of his customers' assets?" "Thodex stopped trading on April 22, coinciding with the disappearance of its chief executive officer (CEO) Faruk Fatih Özer, who is reported to have fled to Thailand with more than US$2 billion." "Özer also closed all his social media accounts, and the customer service line of the Turkish exchange is said to have been disconnected." "Users and media reports had claimed Ozer could have run off with $2 billion but Soylu said the company’s portfolio totaled $108 million."

"Turkish security officials then released a photo of the Thodex founder going through passport control at Istanbul Airport on his way to an undisclosed location. Security sources cited by Turkish broadcaster HaberTürk said earlier he was in Albania’s Tiran." "Police raided the company's headquarters on the Asian side of Istanbul and seized computers and digital materials, press reports revealed." "Turkish police ... detained 62 people as they continue to investigate into the cryptocurrency trading platform Thodex, which is accused of defrauding investors after thousands of users filed criminal complaints saying they had been scammed." "Local authorities detained over 83 individuals suspected to be involved in the case amid growing concerns that Thodex was a scam after the platform halted money withdrawals." "The suspects were apprehended in raids carried out in eight cities including Istanbul, AA reported on Friday."

"Before fleeing Turkey, Ozer reportedly contemplated suicide or giving himself up to the authorities." “I was born as one of the three siblings of a civil servant,” Ozer said in his statement, adding that he’s a high-school dropout. As the company ran into financial trouble, he said he thought about either committing suicide or giving himself up to authorities, but both of those options meant clients’ assets would never be retrieved. “So I decided to stay alive and fight, work and repay my debts to you. The day I repay all my debt, I will return to my country and give myself in to justice.” "Thodex added that a previously undisclosed "cyberattack" impacted roughly 30,000 users causing a "suspicious situation."" "[I]t’s still impossible to say conclusively that this situation is an exit scam. The exchange has gradually been reducing the volume of outgoing transactions since October 2020. The only time the exchange had an increase in the outgoing transaction volume was in March of this year."

"The Turkish Central Bank has recently announced a ban on cryptocurrency payments in the country." "Turkey's central bank says the payment restrictions are necessary due to a lack of a regulatory, "central" authority." "From 30 April, residents in Turkey will be unable to legally pay for goods and services with digital assets." "The Turkish crypto market remains unregulated despite growing scepticism from President Recep Tayyip Erdogan's government about its safety." "In light of the fallout, the Turkish government moved to enforce stricter regulations on cryptocurrency exchanges." "Several government offices are involved in drafting the regulatory framework, including the financial crimes watchdog Masak, the Treasury & Finance Ministry as well as the Capital Markets Board. They expect a draft to be completed within a few weeks." "Orkun Godek, an investment researcher based in the capital Istanbul, remarked, “This market looks like a bottomless pit and regulation is absolutely needed. Risks may trigger new risks. People may close positions elsewhere to counter their crypto losses.”" "Meanwhile, hundreds of thousands of Turks are left gazing at the ruins of their savings and retirement plans, wondering if they will ever recover."

Victim Hulya Ozkal

One victim Holya Ozkal was interviewed by Al Jazeera.

“Maybe it wasn’t millions but I saved half a Bitcoin for the future,” the 65-year old pensioner told Al Jazeera.

Ozkal, who ran a beauty salon and other businesses, said her crypto holdings were worth roughly 279,000 lira (around $33,600). But she fears those assets are now lost forever.

“I thought about burning everything down and committing suicide,” said Ozkal.  “I closed my business, I sold my house. Now I’m in debt.”

Arrests of Siblings

Özer's brother and sister were considered important suspects in the case since both had significant cryptocurrency holdings.

His brother Güven Özer was reported to hold $2.7m USD worth of digital assets on the platforms BTC Turk and Paribu. Güven reportedly served as an active executive at Thodex despite not having an official role at the company.

His sister Serap Özer was reported to have $14.6m USD worth of transactions on her Binance account between 2018 and 2021. She is alleged to have overseen the financial activities at Thodex, however she insists that the account is not hers.

Red Notice Issued

Interpol released a red notice for the Thodex CEO and founder.

Interior minister Süleyman Soylu expressed hope and optimism that he would be returned successfully.

“When he is caught with the red notice, we have extradition agreements with a large part of these countries. God willing he will be caught and he will be returned.”

Ultimate Outcome

CEO Faruk Fatih Özer was ultimately arrested on August 30th, 2022, from his location in Vlora, Albania.

The impression left is of a vulnerable platform, and of a desperate CEO forced through lack of alternatives to flee. There was no visibility or oversight into the backing of funds, and at least 643 bitcoin sat in a single "hot" wallet, without any indication of multi-sig being set up.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

While the Thodex matter is still ongoing, it would appear that the vast majority of people involved have been released at this point. There is also no suggestion that others conspired to assist him in leaving the country with user funds. There is suggestion that Thodex was already in a challenging position, and may have in fact been operating fractionally for some time, and the timing of the closure aligns strongly with a regulatory crackdown that sought to ban cryptocurrency usage as a means of payment in the country.

General Prevention Policies

Thodex violated all three principles of fund safety. Funds were stored online, funds were accessible to one person (the CEO), and the platform continued to operate without a full backing of customer assets. Any level of regulation would have easily prevented what happened.

Our specific framework proposes additional training which would have provided Ozer and associates with additional knowledge about the safety of fund storage, mandated that all funds be stored in a multi-signature wallet which would prevent any one person from taking the funds, and prevented the specific fleeing of the majority of fund holders. In addition, platform backing is subject to periodic review, made available to all users of the platform, and include a proof that all customers are included. A comprehensive collective insurance fund exists to cover any shortfalls and assist long before the platform were to collapse.

Individual Prevention Policies

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The situation with Thodex is largely caused by a single individual accused of escaping with all of the funds. The primary defense against this would be the implementation of a multi-signature wallet.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

However, the platform operated for a significant time frame with alleged fractional reserves. This should be uncovered through a proper audit of the platform, and a plan in place to bring the platform to solvency.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

An industry insurance fund can provide some assistance/relief for users in the worst case scenarios.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.