With a continued bear market for cryptocurrencies, the first multi-billion dollar crypto bankruptcies have started to unfold. In this article Philippa Wilkinson, Senior Associate, examines the much-publicised case of crypto hedge fund Three Arrows Capital Limited ('3AC'), whose founders are evading questions, and warns that insolvency practitioners will need to follow every possible avenue to recover assets in these complex cases.
The ongoing liquidation of multi-billion dollar crypto hedge fund Three Arrows Capital Limited (‘3AC’), originally based in Singapore, has provoked headlines about luxury yachts, the whereabouts of founders Zhu Su and Kyle Davies, and their refusal to answer liquidators' questions on a Zoom call. Crypto analysts continue to monitor known 3AC wallets: a transfer of hundreds of non-fungible tokens (‘NFTs') in early October, estimated by crypto data platform Nansen to be worth 625 ether (around USD 842,000), sparked the latest speculation as to who controlled the new wallet which received the assets, until an announcement by the liquidators confirmed they had taken control of the NFTs.
Behind the headlines, while many of the assets are denominated in a dizzying array of cryptocurrencies, 3AC presents a familiar challenge for asset recovery experts: investigating possible misconduct, fraud and asset stripping by uncooperative directors. As a crypto hedge fund, many of 3AC’s assets are recorded on a distributed ledger rather than in an offshore bank account. The public nature of distributed ledgers, or blockchains, allows any crypto expert to track transactions. A range of crypto Twitter personalities have already done so, documenting 3AC’s June margin calls in real time. But there are many aspects of the 3AC liquidation that will respond to well-established investigative methods.
The downfall of 3AC
The main cause of 3AC’s collapse was excessive leverage on long positions across various cryptocurrencies and related derivatives. According to more than one creditor, the company may have misled its counterparties about the extent of its exposure. As the market began to fall, it became clear that 3AC’s size and interconnections with other crypto investors made it systemically important. Once the fund failed to meet margin calls, the cascading series of liquidations were on such a large scale – alongside other institutions and exchanges which experienced contagion – that they led to a 48 percent fall in the total cryptocurrency market capitalisation over May and June 2022. Similar collapses in traditional hedge funds (such as Archegos Capital Management in 2021) have been exacerbated by the market’s lack of visibility and the obligation for prime brokers to maintain client confidentiality even as margin calls wipe out billions. But 3AC’s positions were, in theory, publicly viewable on the blockchain. Those with the expertise and tools to analyse blockchains could have uncovered 3AC’s wallets, the funds they held, and the smart contracts governing thresholds for margin calls. They would have found the reality of these very different from 3AC’s ‘market neutral’ pitch to investors and lenders.
A blockchain is a decentralised ledger of transactions, made up of a series of timestamped blocks which cannot be subsequently altered. Different validators or miners add new transactions to the blockchain via a consensus mechanism. Most cryptocurrency blockchains are public, and can be viewed by any party, although the volume of data generated is very high. The parties to the transactions, represented by a string of numbers and letters which refers to a particular wallet, are pseudonymous and cannot always be identified."
Wallet watching
In late May and June 2022, as rumours began to circulate in the crypto community that 3AC was failing to respond to a series of margin calls, amateur investigators clubbed together to scrutinise the company, posting on Twitter as well as in crypto focused blogs and media outlets. For example, on 14 June 2022, Twitter user @moonoverlord started posting analytics summarising the activity of well-known 3AC wallets, showing that the hedge fund was the overall largest seller that week of staked Ether (‘stETH’), a derivative representing Ether locked into deposits. They correctly surmised that 3AC was selling to cover margin calls on leveraged positions. The next day, this lead was picked up by crypto news websites such as Blockworks, which reported on several transactions where wallets linked to 3AC withdrew tens of thousands of stETH from Aave (a decentralised finance protocol which pays yield to depositors) converted it to Ether at a discount, and returned it to Aave to repay a loan. Blockworks estimated the value of the stETH at the time as over USD 135 million.
Once the fund failed to meet margin calls, the cascading series of liquidations were on such a large scale that they led to a 48 percent fall in the total cryptocurrency market capitalisation."
Similarly, on 15 June @moonoverlord tracked a major transfer of non-fungible tokens (‘NFTs’), primarily digital art on which 3AC’s dedicated Starry Night Capital fund had spent around USD 21 million, from various 3AC wallets to a single unidentified wallet. It was unknown who controlled the latter wallet. While observers speculated at the time that a firesale was planned, this never took place. The liquidators raised the possibility in a leaked 9 July bankruptcy application to the Singapore High Court that the 15 June transfer was one of several attempts observed on the blockchain to transfer assets out of reach of creditors. However, by 4 October, the liquidators managed to take control of the NFT collection, thanks to the cooperation of an independent partner in the Starry Night Capital fund.
The challenge of unpicking the blockchain
3AC has a sprawling, complex presence on the blockchain. And so despite its high profile, identifying 3AC’s wallets and mapping its assets is a challenging task requiring extensive research and crypto knowledge. However, in June 2022, enough crowd-sourced on-chain sleuthing allowed observers to watch 3AC’s on-chain investments be liquidated in real time. On 23 June, Twitter user @fatmanterra estimated that 3AC’s remaining assets, mainly illiquid equities and crypto tokens, were worth only USD 400m, against USD 2 billion of debts. This was some way short of the USD 3.575 billion total debt disclosed in documents which supported the 9 July Singapore filing, showing the gap between what is realistically discoverable on the blockchain, and the context and detail provided by other documentary and insider sources. Bloomberg reported in July that the liquidators had then recovered around USD 40m of assets. Multiple analysts continue to monitor 3AC connected wallets to catch new transactions in real time.
Combining OSINT and on-chain analysis
The leaked Singapore court filing contained a wealth of detail on 3AC’s finances, demonstrating that creditors and liquidators had already begun investigating 3AC’s assets and recent transfers. It also gave social media investigators new information on the contracts that governed the larger loans, and the last-minute negotiations around margin calls, triggering a new round of investigations into 3AC’s recent actions. The investigators working on behalf of the creditors combined OSINT, or open source research, with blockchain analytics in the affidavits. They connected the rumours of liquidations circulating in the crypto industry and emerging on social media, to extracts from the blockchain showing key transactions. For the liquidators, a massive task lies ahead which will require all methods of investigation: identifying and mapping every crypto wallet and asset controlled by 3AC, and securing the private keys that allow access, without the founders’ cooperation.
For the liquidators, a massive task lies ahead which will require all methods of investigation: identifying and mapping every crypto wallet and asset controlled by 3AC, and securing the private keys that allow access, without the founders’ cooperation."
Even more challenging will be identifying on-chain counterparties to which assets may have been fraudulently transferred. Investigators will need to connect wallet addresses to real entities and individuals who might respond to the liquidators’ legal powers to claw back assets. For example, the liquidators noted that on 16 June, 3AC transferred USDT 10.9 million, a stablecoin pegged to the US dollar, to an unknown wallet. The USDT was transferred out 6 minutes later, to a second unknown wallet. The second wallet is an active trader and the current status of the funds is unclear. While connecting pseudonymous cryptocurrency wallets with owners is occasionally possible using a creative synthesis of OSINT and on-chain analysis, there is no guarantee that the recipient of the USDT 10.9 million will ever be identified and the funds returned.
Going back to basics
While the novel blockchain investigations are yielding impressive results, 3AC’s operations and assets were never solely confined to the blockchain. For example, Zhu Su’s conversion of crypto assets to lifestyle assets has been extensively reported in both crypto and mainstream media. In December 2021, Zhu Su and his wife acquired an option to purchase a SGD 48.8 million (USD 34.7 million) luxury property in Singapore in trust, on behalf of one of their children. Zhu Su and his wife each own luxury properties in Singapore, worth SGD 6.25 million (USD 4.4 million) and SGD 28.5 million (USD 20.4 million) respectively. The liquidators have already obtained corresponding property records and are attempting to seize the properties, according to media reports. Most notoriously, Zhu Su reportedly ordered a USD 50 million yacht named ‘Much Wow’, which remains at an Italian shipyard and may also be targeted by the liquidators as an alleged fraudulent transfer.
As the liquidation of 3AC unfolds, there will be extensive OSINT and on-the-ground investigative work required to track down real world assets which the founders may be concealing. Not least, a priority is to locate Zhu Su and Kyle Davies, who have been on the run since early July and have rarely been active on social media since then. There have been rumoured sightings in Dubai and Bangkok, as yet unconfirmed. The key to tracking down the fugitives will not be on-chain analysis, but good old fashioned local contacts and boots on the ground.
As the liquidation of 3AC unfolds, there will be extensive OSINT and on-the-ground investigative work required to track down real world assets which the founders may be concealing."
The notoriously volatile crypto market will continue to claim victims, and we expect further allegations of fraud to emerge. Investigators must acquire new skills to tackle the complexity of on-chain analysis, but their long-honed investigation skills and instincts will remain core to connecting every piece of the fraud puzzle.
