Thodex CEO Flees Collapse

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Thodex

Thodex was a large cryptocurrency exchange based in Turkey, which operated since 2017. Shortly after Turkey started requesting more information from users of cryptocurrency exchange platforms, then banned the use of cryptocurrencies for payments in the country, the platform shut down and it's CEO fled to Albania. There were widespread reports that $2b in assets were lost as a result, however the interior minister reported that the figure was closer to $108m. The CEO was ultimately arrested an entire year later. It is unclear what portion of funds have been returned to users.

About Thodex

Thodex operated since 2017 and had about 700,000 clients in Turkey. Exchange trading volumes were reportedly in the billions of dollars.

"Thodex was part of the cryptocurrency boom that has drawn in legions of Turks seeking to protect their savings from rampant inflation and an unstable currency. Inflation hit 16.2% in March, more than three times the central bank’s target of 5%. The Turkish lira has weakened 10% against the dollar this year, its ninth consecutive year of losses." "A survey by the World Economic Forum published in February found that 16 percent of Turks said they used or owned cryptocurrency – level pegging with Peru which, along with Turkey, ranked fourth globally after Nigeria, Vietnam and the Philippines, where the currencies are used for overseas remittances." "Thodex announced on its website that it would be unavailable for several days to handle a sales process. The vague message didn’t reveal details such as when it would be back and if the users’ funds were safe, prompting investors to start voicing their frustration." "Trading at the platform stopped and investors started to contact the authorities. Complaints against the crypto exchange skyrocketed by more than 1,160% compared to the previous week." "Thodex clients and investors were left with unanswered questions about when they would be able to recover their money." "In a statement, the exchange claimed that it had found an ‘abnormality’ in its accounts and that it shut down the exchange to investigate this."

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

Thodex CEO was only 27 years old.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Thodex CEO Flees Collapse

Date	Event	Description
April 1st, 2021 10:56:00 AM MDT	Turkey Demands User Information	Turkish authorities start to request user information from different cryptocurrency exchanges throughout the country, stating this is to help tackle financial crimes in the country.
April 16th, 2021 2:42:00 AM MDT	Turkey Bans Cryptocurrencies	Turkey's central bank releases new regulation which announce a ban on the use of cryptocurrency assets for payments. Reports widely surface about this in BeInCrypto and local Turkish newspaper Alarabiya News. The ban officially goes into effect on April 30th, 2021.
April 16th, 2021	Doge Exchange Rate Mismatch	Between April 14th and April 16th, the market price of Dogecoin increased from $0.11 USD to $0.42 USD on global exchanges, however it stayed priced at the low price of $0.11 USD on Thodex.
April 17th, 2021 12:41:36 PM MDT	Last Recorded Withdrawal	The last time that a withdrawal is recorded from the Thodex hot wallet, according to CoinDesk.
April 20th, 2021 11:00:00 AM MDT	CoinMarketCap Data Stops	" CoinMarketCap spokesperson tells CoinDesk that the exchange stopped providing trading data around 1 p.m. EDT on Tuesday. "
April 21st, 2021	Thodex Suspends Operations	Thodex posts a notice on their website explaining that they have suspended operations due to a partnership offer. The service promised that it would remain shut for only 5 days.
April 21st, 2021	Ozer Flees Turkey	Thodex CEO and founder Faruk Fatih Ozer reportedly leaves from Istanbul, Turkey to Tirana, the capital of Albania, on a commercial flight. This was described as being to meet with "foreign investors".
April 21st, 2021 7:18:00 AM MDT	Bloomberg Thodex Article	Bloomberg publishes an article on the situation. (TBD - Information about report.)
April 21st, 2021 8:08:00 MDT	Loss Amount Questioned	Questions around the total amount of the platform are raised on Twitter.
April 22nd, 2021 3:39:00 AM MDT	Bloomberg Reports Thodex Goes Bust	Bloomberg publishes another article. "One of Turkey’s largest cryptocurrency exchanges said it lacked the financial strength to continue operations, leaving hundreds of thousands of investors fearing their savings have evaporated as authorities sought to locate the company’s 27-year-old founder, who fled the country".
April 22nd, 2021 6:49:00 AM MDT	Ozer Defends Himself On Twitter	Ozer posts a three-page statement in Turkish on Twitter in an attempt to defend himself, calling the accusations "baseless". "I would like it to be known that; As I have never done anything in my life that would harm neither my state nor my nation, I consider it cruel to even attribute such a thought to me."
April 22nd, 2021 8:45:00 AM MDT	Fraud Complaint Filed	Users of the Thodex platform reportedly filed a fraud complaint. Some Thodex employees are detained.
April 22nd, 2021 10:46:10 AM MDT	Deutsche Welle Article	Deutsche Welle publishes an article on Thodex. TBD fill in more details.
April 22nd, 2021	Demiroren News Agency Releases CCTV Footage	Demiroren News Agency reportedly released CCTV footage. TBD find more about that release.
April 23rd, 2021 2:10:00 AM MDT	Bloomberg Reports Manhunt	Bloomberg reports that the Justice Ministry has issued a red notice for Faruk Fatih Ozer and described the situation as a manhunt.
April 23rd, 2021 3:14:00 AM MDT	Daily Sabah Article Published	Daily Sabah article published. (Review and expand.)
April 23rd, 2021 4:34:58 AM MDT	TRT World Article Published	TRT World publishes an article on the Thodex exchange collapse. TBD fill in more details. Check history of modifications.
April 23rd, 2021 6:56:09 AM MDT	Bank Info Security Article Published	Bank Info Security publishes an article about the Thodex situation. TBD fill in more details.
April 24th, 2021 7:16:29 PM MDT	Anadolu Agency Article	An article is published by Anadolu Agency. (Review and expand.)
April 26th, 2021 1:24:41 AM MDT	ZDNet Article	The Thodex situation is published on ZDNet. This article reports that the founder has fled the country with "billions of dollars in user assets", "approximately $2 billion in funds with him which belongs to 391,000 investors". It's reported "thousands of Turkish citizens have now filed criminal complaints" and the Justice Ministry has issued a red notice for Ozer. The Thodex website is apparently calling the situation a "baseless" "smear campaign", that they temporarily closed to resolve an "abnormality" in the company accounts, and that Ozer left Turkey to meet with "foreign investors". The Thodex website also claims there was an undisclosed cyber-attack causing a "suspicious situation", that the company is "prevented from continuing its commercial life" as "a result of the perception of victimization created in the public [space]", and that Ozer will be returning to Turkey to cooperate with authorities. Ozer's original Twitter account was closed down and a new account is sharing company statements. (Need to add more/investigate on the Twitter accounts.)
April 29th, 2021 5:11:08 AM MDT	CoinGeek Article Published	CoinGeek publishes an article covering the situation. TBD fill in details.
April 30th, 2021 4:57:27 AM MDT	CoinTelegraph Report	CoinTelegraph reports an update. This article reports that a red notice has been issued for Özer, 6 have been jailed and 83 others have been detained in the case, and information about Özer's siblings as supected. The company's portfolio is reported as totaling $108m, referencing reports from interior minister Soylu.
April 30th, 2021 8:48:00 AM MDT	Alarabiya Article Published	Alarabiya reports on the Thodex exchange collapse. TBD fill in more details of this article.
May 3rd, 2021 12:14:09 AM MDT	Forkast Article Published	Forkast publishes an article on the Thodex collapse. TBD fill in more details.
May 3rd, 2021 7:48:00 AM MDT	BeInCrypto Article	BeInCrypto publishes an article on the exchange. The article is also published through Yahoo Finance.
May 5th, 2021 10:52:02 AM MDT	Al Jazeera Article	News of the Thodex collapse reaches Al Jazeera with a full article including an interview with one of the victims. TBD add more details, summary.
May 31st, 2021 9:34:32 AM MDT	Hot Wallet Transfer 1	There is a further transfer of 0.04953400 BTC from the Thodex hot wallet.
June 14th, 2021 8:22:16 AM MDT	Hot Wallet Transfer 2	There is a further transfer of 1.03800000 BTC from the Thodex hot wallet.
June 14th, 2021 11:51:57 AM MDT	Hot Wallet Transfer 3	There is a further transfer of 1.22000000 BTC from the Thodex hot wallet.
June 16th, 2021 12:58:36 AM MDT	Hot Wallet Transfer 4	There is a further transfer of 1.84491331 BTC from the Thodex hot wallet.
June 15th, 2021 1:25:15 AM MDT	Hot Wallet Transfer 5	There is a further transfer of 1.88270733 BTC from the Thodex hot wallet.
March 31st, 2022 9:58AM MDT	Prison Set At 40,564 Years	There are reports that he may face 40,564 years in prison. Bloomberg publishes a popular article on the proposed sentence by a Turkish prosecutor. "The indictment on Istanbul-based Thodex seeks sentences of up to 40,564 years for each of the 21 defendants."
August 30th, 2022 6:21:44 AM MDT	CoinMarketCap Alexandria Article	An article about arrest appears online in CoinMarketCap Alexandria. TBD add summary of article.
August 30th, 2022	Arrest In Albania	Faruk Fatih Özer was arrested by authorities in the city of Vlora, Albania, confirmed by biometric results. Laptops, mobile phones, and bank cards were also seized.
September 6th, 2022 12:15:51 AM MDT	CoinMarketCap Alexandria Article	The CoinMarketCap Alexandria article is update. TBD investigate update.

Technical Details

Limited information is available about what happened behind the scenes in Thodex.

Total Amount Lost

Different totals have been floated at various times.

Different Sources Reporting Different Losses on Thodex Exchange

Source	Date	Users	Loss Amount	Quote
BeInCrypto	April 22nd, 2021	"390,000"	"hundreds of millions"
SlowMist	April 22nd, 2021	-	"$24 million to $2.5 billion"
Deutsche Welle	April 22nd, 2021	"400,000" "391,000"	"$2 billion (€1.7 billion)"	"Thodex after its founder shut down its site and reportedly fled the country with as much as $2 billion (€1.7 billion) in investors' assets" "400,000 members, of whom 391,000 are active in trading"
TRT World	April 23rd, 2021	"391,000"	"at least $2 billion"	"its founder fled with a reported $2 billion in investors' assets" "the exchange shut down while holding at least $2 billion from 391,000 investors"
Bank Info Security	April 23rd, 2021	"390,000"	"$2 billion"	"Accused of Fleeing to Albania With $2 Billion in Funds", "fleeing the country with $2 billion worth of his customers' assets", "disappearing with up to $2 billion in assets" "Thodex has about 390,000 active users"
ZDNet	April 26th, 2021	"391,000"	"$2 billion"
CoinGeek	April 29th, 2021	"close to 400,000"	"$2 billion"	"an exchange suspected of taking $2 billion from close to 400,000 investors"
CoinTelegraph	April 30th, 2021	-	"totaled $108 million"	"As previously reported, the missing Thodex CEO is reported to have run off with as much as $2 billion worth of crypto, but according to the latest reports, interior minister Soylu said that the company’s portfolio totaled $108 million."
Alarabiya	April 30th, 2021	-	"$2 billion", "$108 million"	"Users and media reports had claimed Ozer could have run off with $2 billion but Soylu said the company’s portfolio totaled $108 million."
Forkast	May 3rd, 2021	-	"more than US$2 billion"	"Faruk Fatih Özer, who is reported to have fled to Thailand with more than US$2 billion"
Al Jazeera	May 5th, 2021	"400,000"	"$2bn"	"Thodex’s CEO, who reportedly fled to Albania with $2bn belonging to some 400,000 clients"

The total amount lost has been estimated at $2,000,000,000 USD, though this amount is questioned. TBD need to resolve how much was actually lost.

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Twitter Statement And Reactions

Shortly after fleeing Turkey, owner Faruk Fatih Ozer took to Twitter with a three page statement. The text is in Turkish and formatted as an image, so it is only readable in English through the use of OCR and translators combined.

Dear users of Thodex,

1/3

There has been a need to inform the public and the dear users who use our Thodex Platform regarding the process we have been through.

First of all I want to indicate; my company Koineks Teknolojileri A.Ş. and most of the claims made about the Thodex platform it owns are baseless.

Thodex platform, where nearly 700,000 users are trading, has not victimized anyone so far and will not do so from now on. 25.000.000.00-TL, which occurred as a result of the cyber attack against our company in 2018. Without reflecting the damage to any of our users, our company tolerated it with its own means and made a serious infrastructure system change in order not to experience a cyber attack again.

Considering both the financial structure of the company and the number of users in the process, it attracted the attention of many domestic and foreign investors, and received very serious partnership offers at the international level. During the partnership negotiations, which have been going on for about 3 months, when the financial and digital data are examined together, it has been determined that there is an abnormal fluctuation in the company accounts as of last week. Thodex Platform has been temporarily closed to determine the reasons and sources of this.

While the company's technical team was doing this research, I personally went abroad on 19.04.2021 to make final negotiations with the foreign investor.

2/3

In the examination made on the company accounts, it was determined that the cyber attack event continued and the correct data of some account holders could not be reached.

The allegations that were made public on April 22, 2021 that I disappeared after causing a loss of approximately 2 billion USD to approximately 391,000 people are unfounded. In order to respond urgently to these claims that go beyond the limits of fairness and understanding, I have had to make this statement.

Firstly; According to our initial findings, only about 30,000 of our nearly 700,000 users have a suspicious situation, and the bank login fees of these people are available in their company accounts on the platform. In this respect; First of all, I announce to the public that no user will be victimized.

MOREOVER; IT CAN BE PERCEIVED BY SOME PEOPLE BY INTRODUCING THEIRSELF AS SPECIALISTS, IN SOCIAL MEDIA AND THROUGH THE PRESS, THE PUBLIC CAN MAKE A PERCEPTION LIKE 2 BILLION USD, WITH AN AMOUNT THAT DOESN'T CONSIDER WITH MIND, LOGIC AND ACCOUNT. FOR; LEAVE THE TRADING VOLUME OF THODEX THE TRADING VOLUME OF ALL CRYPTO PLATFORMS IN TURKEY IS NOT AT THIS LEVEL.

3/3

Thus; The records of our company were previously submitted to the information of institutions such as MASAK, CMB, Ministry of Treasury and Finance, and it is also confirmed by the records of the relevant institutions that there is no irregularity.

This process has turned into a slander campaign with inaccurate and exaggerated statements, causing harm to both users and myself. For; According to our findings, payments of around 30,000 users will be made after their accounts are cleared. While our company, with a market value of approximately 40 million USD as of today, can continue its commercial life, it is tried to prevent our company from continuing its commercial life as a result of the perception of victimization created by the public.

What I would like to ask dear users is that the statements not made by our company should not be respected. I personally declare that by returning to Turkey in a few days, I will ensure that the truth is revealed in cooperation with the judicial authorities and I will do my best to prevent the victimization of users. I would like it to be known that; As I have never done anything in my life that would harm neither my state nor my nation, I consider it cruel to even attribute such a thought to me.

In this way; I respectfully submit to the public's knowledge that the smear campaign against both myself and my company should not be respected.

Faruk Fatih Ozer

THODEX

The top comment on Twitter appears to express support for Faruk, however requests him not to run away. Other comments expressed to join rival exchange Binance and that the $2 billion figure was entirely fabricated as part of an attack on cryptocurrency.

I wish you had said this at first, Faruk, it is difficult to gain trust, it is easy to lose, there is nothing to do anyway, we are waiting for you, save your honor, there is someone who trusts you and invests everything in you, I don't know how you should clean this stain that does not suit your cement, but you will not get anywhere by running away

Create a free Binance account... And have peace of mind with your money..

Funds are not #SAFU this time We are waiting for photos like budgies from wherever you go. They just made up $2 billion to screw up the crypto thing.

"Rumors have since been rife that Thodex owner Faruk Fatih Ozer has fled the country with the intent of defrauding users of their estimated $2 billion total in crypto." "Has the CEO of the Thodex cryptocurrency exchange in Turkey exit-scammed, fleeing the country with $2 billion worth of his customers' assets?" "Thodex stopped trading on April 22, coinciding with the disappearance of its chief executive officer (CEO) Faruk Fatih Özer, who is reported to have fled to Thailand with more than US$2 billion." "Özer also closed all his social media accounts, and the customer service line of the Turkish exchange is said to have been disconnected." "Users and media reports had claimed Ozer could have run off with $2 billion but Soylu said the company’s portfolio totaled $108 million."

"Turkish security officials then released a photo of the Thodex founder going through passport control at Istanbul Airport on his way to an undisclosed location. Security sources cited by Turkish broadcaster HaberTürk said earlier he was in Albania’s Tiran." "Police raided the company's headquarters on the Asian side of Istanbul and seized computers and digital materials, press reports revealed." "Turkish police ... detained 62 people as they continue to investigate into the cryptocurrency trading platform Thodex, which is accused of defrauding investors after thousands of users filed criminal complaints saying they had been scammed." "Local authorities detained over 83 individuals suspected to be involved in the case amid growing concerns that Thodex was a scam after the platform halted money withdrawals." "The suspects were apprehended in raids carried out in eight cities including Istanbul, AA reported on Friday."

"Before fleeing Turkey, Ozer reportedly contemplated suicide or giving himself up to the authorities." “I was born as one of the three siblings of a civil servant,” Ozer said in his statement, adding that he’s a high-school dropout. As the company ran into financial trouble, he said he thought about either committing suicide or giving himself up to authorities, but both of those options meant clients’ assets would never be retrieved. “So I decided to stay alive and fight, work and repay my debts to you. The day I repay all my debt, I will return to my country and give myself in to justice.” "Thodex added that a previously undisclosed "cyberattack" impacted roughly 30,000 users causing a "suspicious situation."" "[I]t’s still impossible to say conclusively that this situation is an exit scam. The exchange has gradually been reducing the volume of outgoing transactions since October 2020. The only time the exchange had an increase in the outgoing transaction volume was in March of this year."

"The Turkish Central Bank has recently announced a ban on cryptocurrency payments in the country." "Turkey's central bank says the payment restrictions are necessary due to a lack of a regulatory, "central" authority." "From 30 April, residents in Turkey will be unable to legally pay for goods and services with digital assets." "The Turkish crypto market remains unregulated despite growing scepticism from President Recep Tayyip Erdogan's government about its safety." "In light of the fallout, the Turkish government moved to enforce stricter regulations on cryptocurrency exchanges." "Several government offices are involved in drafting the regulatory framework, including the financial crimes watchdog Masak, the Treasury & Finance Ministry as well as the Capital Markets Board. They expect a draft to be completed within a few weeks." "Orkun Godek, an investment researcher based in the capital Istanbul, remarked, “This market looks like a bottomless pit and regulation is absolutely needed. Risks may trigger new risks. People may close positions elsewhere to counter their crypto losses.”" "Meanwhile, hundreds of thousands of Turks are left gazing at the ruins of their savings and retirement plans, wondering if they will ever recover."

Victim Hulya Ozkal

One victim Holya Ozkal was interviewed by Al Jazeera.

“Maybe it wasn’t millions but I saved half a Bitcoin for the future,” the 65-year old pensioner told Al Jazeera.

Ozkal, who ran a beauty salon and other businesses, said her crypto holdings were worth roughly 279,000 lira (around $33,600). But she fears those assets are now lost forever.

“I thought about burning everything down and committing suicide,” said Ozkal.  “I closed my business, I sold my house. Now I’m in debt.”

Arrests of Siblings

Özer's brother and sister were considered important suspects in the case since both had significant cryptocurrency holdings.

His brother Güven Özer was reported to hold $2.7m USD worth of digital assets on the platforms BTC Turk and Paribu. Güven reportedly served as an active executive at Thodex despite not having an official role at the company.

His sister Serap Özer was reported to have $14.6m USD worth of transactions on her Binance account between 2018 and 2021. She is alleged to have overseen the financial activities at Thodex, however she insists that the account is not hers.

Red Notice Issued

Interpol released a red notice for the Thodex CEO and founder.

Interior minister Süleyman Soylu expressed hope and optimism that he would be returned successfully.

“When he is caught with the red notice, we have extradition agreements with a large part of these countries. God willing he will be caught and he will be returned.”

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

CEO Faruk Fatih Özer was ultimately arrested on August 30th, 2022, from his location in Vlora, Albania.

The impression left is of a vulnerable platform, and of a desperate CEO forced through lack of alternatives to flee. There was no visibility or oversight into the backing of funds, and at least 643 bitcoin sat in a single "hot" wallet, without any indication of multi-sig being set up.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

While the Thodex matter is still ongoing, it would appear that the vast majority of people involved have been released at this point. There is also no suggestion that others conspired to assist him in leaving the country with user funds. There is suggestion that Thodex was already in a challenging position, and may have in fact been operating fractionally for some time, and the timing of the closure aligns strongly with a regulatory crackdown that sought to ban cryptocurrency usage as a means of payment in the country.

General Prevention Policies

Thodex violated all three principles of fund safety. Funds were stored online, funds were accessible to one person (the CEO), and the platform continued to operate without a full backing of customer assets. Any level of regulation would have easily prevented what happened.

Our specific framework proposes additional training which would have provided Ozer and associates with additional knowledge about the safety of fund storage, mandated that all funds be stored in a multi-signature wallet which would prevent any one person from taking the funds, and prevented the specific fleeing of the majority of fund holders. In addition, platform backing is subject to periodic review, made available to all users of the platform, and include a proof that all customers are included. A comprehensive collective insurance fund exists to cover any shortfalls and assist long before the platform were to collapse.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The situation with Thodex is largely caused by a single individual accused of escaping with all of the funds.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.