Summary of Financial Management Concepts Needed for Web3 Based on the Bybit Compensation Incident

On July 28th, ‘WuShuo Blockchain’ reported the "Bizarre Case: Bybit Payroll Responsible Steals a Large Amount of USDT - Singapore Court Explains the Nature of Cryptocurrency Property." This event has sparked discussions within the industry. This article provides an analysis and summary from a financial management perspective.

Event Overview

Cryptocurrency exchange Bybit sued its payroll officer, Ms. Ho Kai Xin (Ms. Ho), for abusing her authority to transfer a significant amount of USDT to addresses secretly owned and controlled by her. The Singapore High Court upheld a judgment requiring Ms. Ho to repay all transferred funds and interest to Bybit.

Event Analysis

1. ByBit Fintech Limited ("ByBit") sought a judgment against Ms. Ho for violating her employment contract and abusing her position to transfer USDT to addresses she secretly owned and controlled, as well as transferring fiat currency to her own bank account. ByBit requested the return of equivalent amounts or traceable profits. Observations:Ms. Ho had sole control over cryptocurrency and fiat accounts for payroll, lacking multi-level authorization.There were significant flaws in the fund control process (Lack of internal controls related to the account is a big gap even if it only costs a dollar).
2.                Ms. Ho's role included maintaining a Microsoft Excel spreadsheet that recorded monthly payments in both cash and cryptocurrency for ByBit employees (This document was known as the "Fiat Excel file" for cash payments and the "Cryptocurrency Excel file" for cryptocurrency payments.) ByBit employees could and often did provide Ms. Ho with new addresses to update their payment details. Ms. Ho would then make the necessary updates to the Cryptocurrency Excel file. She was the only person with access to this file and had the exclusive ability to update it. Furthermore, each month, Ms. Ho was required to submit the Cryptocurrency Excel file to her immediate supervisor, Casandra Teo, for approval.

Observations:

•                            Payee address collection process lacked proper control and traceability.
•                            Address verification was limited and lacked a multi-source confirmation mechanism.

1. On 7 September, 2022, ByBit discovered eight unusual cryptocurrency transactions ("abnormal transactions") that occurred between 31 May, 2022, and 31 August, 2022. These transactions involved a substantial transfer of USDT to four addresses (referred to here as Address 1, Address 2, Address 3, and Address 4). In total, 4,209,720 USDT ("cryptocurrency assets") were transferred. USDT is named as such because its value is pegged to the US dollar, and each USDT provides its holder (referred to as "verified clients" of the issuer Tether Limited) with contractual rights to exchange their USDT for US dollars. These abnormal transactions were recorded in an Excel spreadsheet ("Reconciliation Excel file"), and Ms. Ho was tasked with explaining these discrepancies. Initially, Ms. Ho attributed the abnormal transactions to inadvertent or technical errors and proposed calculating the amount that needed to be recovered from ByBit's employees.

Observations:

•                            Internal reconciliation process was present but time-delayed. It may be related to the reason that the middle and back-office support cannot keep up with the high volume of business.
•                            Post-facto rectification proved more costly than proactive planning.

1. ByBit also discovered that Ms. Ho caused $117,238.46 USD ("fiat assets") to be paid into her personal bank account in May 2022. Undoubtedly, Ms. Ho had no authority to receive fiat currency.

Observations:

•        Even fiat currency accounts were compromised, and it's puzzling. Traditional tasks like fiat payroll, whether in terms of processes or tools, should have numerous cases.
•        Even if payroll is entrusted to HR for payment and authorization due to salary confidentiality reasons (some tasks are separated from financial control), the basic processes of payroll preparation, bank payment execution, and authorization need to be kept separate.

Applicable Financial Management Concepts for Web3

After years of development, Web3 has not only produced numerous industry giants but has also been attracting an increasing number of individuals from Web2. When considering the evolution of regulatory and compliance landscapes over the past two years, it becomes imperative for an increasing number of Web3 companies to pay serious attention to essential financial management strategies and tools:

1. Secure Cryptocurrency and Fiat Accounts: Implement multi-level authorization and separation of collection, operation, and authorization points. Verify information from different sources to avoid single-point vulnerabilities.
2. Financial Verification Mechanism: Implement regular reconciliations and record-keeping, ensuring that the same information is verified from multiple sources to avoid relying on a single point of data and enable traceability. The frequency of verification should not exceed one month. This verification mechanism ensures a "business loop," where occurrences and their accuracy are mutually validated and kept on track.
3. Accounting Records - Including Cryptocurrencies: Maintaining comprehensive and accurate accounting records, along with a traceable evidence trail, significantly reduces the risk of internal control failure. Additionally, utilizing accounting records facilitates business management and helps fulfill external compliance obligations. (The chaotic accounting records of FTX are also believed to have contributed to its collapse to some extent.)
4. The Necessity of Internal Controls: It's crucial to possess a strong sense of business management and internal controls. By integrating excellent automated management software that embodies extensive practical experience in internal controls, accounting, and taxation, you can maximize the assurance of maintaining the stability and longevity of your cryptocurrency venture.

第1页

第1页