The "multiple personality" that once "falsified" 70% of Solana's TVL is now looking towards Aptos

Written by: Coindesk, "Master of Anons: How a Crypto Developer Faked a DeFi Ecosystem"

Compiled by: Shiwen, Odaily Planet Daily

For crypto user Saint Eclectic, the practices of Sunny Aggregator (a DeFi aggregator on Solana) seemed a bit unusual.

Sunny's native token surged fivefold during last summer's bull market. By early September, just two weeks after its launch, billions of dollars in cryptocurrency had flowed into this yield farm.

However, Saint and others still had questions: Who is behind Sunny? Why did this developer use the pseudonym "Surya Khosla"? Was its codebase audited? Is users' cash safe?

"There was no indication of who Surya was," Saint recalled recently, "Many users felt it wasn't safe to put their cryptocurrency in."

It turned out their suspicions were correct. CoinDesk learned that Surya's real name is Ian Macalinao, the chief designer of Sabre (a stablecoin exchange on Solana). He built Sunny Aggregator on top of Saber.

In his twenties and hailing from Texas, Ian developed as one of 11 independent developers, creating a massive network of DeFi protocols that projected billions of dollars of double-counted value into the Saber ecosystem. Last November, as the network raced toward its peak, it briefly inflated Solana's total value locked (TVL) — a metric that loyal DeFi users often view as a barometer of on-chain activity.

"I designed a scheme to maximize Solana's TVL: I would build interlocking protocols so that $1 could be counted multiple times," Ian wrote in an unpublished blog post commented on by CoinDesk. This blog post was prepared on March 26, just three days after one of the protocols Ian secretly built, Cashio, lost $52 million in a hack.

Those familiar with the matter confirmed the authenticity of the content.

Peak Performance

Ian's strategy worked for a while. According to his statistics, Sabre and Sunny once accounted for $7.5 billion of Solana's peak TVL of $10.5 billion. (Billions of dollars were double-counted between his two protocols.)

"I believe it contributed to the rise in SOL's price," Ian wrote when SOL was priced at $188.

According to data provider DeFiLlama, even as the Saber ecosystem began to lose momentum in mid-September 2021, the TVL of the Solana network continued to swell, reaching around $15 billion by November 9, while Sabre's TVL had already dropped by 64%.

Ian wrote that he looked down on this "vanity metric"; although "Ethereum's TVL is much higher than Solana's TVL, which bothers me," because in his view, DeFi projects on Ethereum are "stacked" and can double-count deposits.

"I wanted to create a system very similar to this," he wrote. One issue was: "If every protocol is built by the same team, then TVL as a metric becomes even more foolish. So I created more anonymous profiles," he wrote.

Ian wore 11 masks.

In public, Ian and his brother Dylan referred to their anonymous roles as "friends" or "friends of friends." Their "Ship Capital" programmer club was sketching out a blueprint for "my ideal DeFi ecosystem," Ian wrote in an unpublished blog. Saber and its so-called LP tokens supported everything.

"If an ecosystem is built by just a few people, it doesn't look as real," Ian wrote in his blog post. "I wanted it to look like many people were building our protocols, rather than treating 20 unrelated programmers as one person running it."

Ian hoped that other crypto protocols could rely on Saber to the extent that "its failure could lead to the collapse of the entire system," Dylan said on October 1, 2021. "This is the strategy of Saber Labs, but few understand…"

As of the time of publication, the Macalinao brothers had not provided any comments.

"Witch Hunt"

Using anonymity might have been justified. However, "anonymity" Ian initiated a witch hunt, abusing the trust of cryptocurrency users. (A witch hunt refers to a computer in the network using a false identity to gain a detrimental influence over the entire network.)

"I reveal these because I will definitely be found out," Ian wrote in his unpublished blog.

However, in May, Ian launched "Sabre Public Goods" to spread the prolific code of the "Sabre team" throughout Solana. Eight of Ian's 11 secret projects appeared there. But they did not disclose anything about anonymity.

"My Anonymous Army"

Ian created Sunny Aggregator under the name Surya Khosla and launched Twitter in August 2021. Sunny's skeptic, Saint Eclectic, hesitated to deposit his LP tokens into this mysterious figure's project, which featured an AI-generated face.

One factor worked in Surya's favor: Ian's puppet claimed to "know Dylan very well in real life." On September 9 last year, Dylan Macalinao tweeted, "It feels good to put your cryptocurrency into Sunny Aggregator," "We audited their code."

Dylan provided Surya with the credibility needed to win the trust of skeptics like Saint Eclectic.

The problem was that the main developer "Surya Khosla" did not exist. Dylan's brother Ian built Sunny Aggregator. Ian fabricated Surya.

This was not Ian's first use of a false identity for Saber, and it was far from the last.

In March 2022, Ian wrote that he had created 11 "anonymous founders, all of whom were actually fabricated by himself."

According to Ian's blog, he admitted to creating a batch of lesser-known protocols like Crate (run by kiwipepper), aSOL (0xAurelion), Arrow (oliver_code), Traction.Market (0xIsaacNewton), Sencha (jjmatcha), and Venko App (ayyakovenko), which were DeFi Lego blocks that were gems of the Saber ecosystem.

Behavior Among Anonymity

Ian, Dylan, and puppet anonymous figures constantly promoted the work of Ship Capital on social media. They praised each other's projects and continuously encouraged and publicized the achievements of builders.

On December 29, Solana developer Armani Ferrante (a real person) tweeted, "If you’re not making mistakes, you’re going too slow," to which five of Ian's puppets responded within four minutes:

@_kiwipepper responded, "As @simplyianm said, this is an experiment!" She was one of them.

Others wavered in the face of the facts.

We cannot determine whether these statements were manipulated by Ian from the Twitter backend. But two people who had previously worked with Ship Capital recalled the inexplicable behavior of its team members: one character's Telegram account would come online after another character logged off.

Regardless, Ian indicated in an unpublished article: "If you are a developer, it is easy to find out which open-source protocols I wrote: there is always a 'flake.nix' file that only I use."

CoinDesk verified that many projects described in Ian's blog contained a "flake.nix" file.

Starting with Cashio

To understand how the "anonymous army" injected double-counted value into Saber, the Cashio project created by 0xGhostchain provides a compelling perspective.

Cashio's CASH debuted in November last year near the peak of the crypto market, touted as a "decentralized stablecoin," its cryptocurrency pegged to the dollar was backed by "liquidity provider" tokens.

Cashio only accepted Saber’s LP tokens as collateral. This was not surprising in November last year when Saber was an "automated market maker" with over $1 billion in TVL, a major DeFi trading venue for stablecoin pairs on Solana.

Cashio relied on the Saber ecosystem projects created by Ian's anonymous figures to generate yield.

It first used Crate to bundle Saber LP tokens into "tokenized baskets," which Ian established under the pseudonym "kiwipepper." It sent these "baskets" through a yield redirect platform called Arrow — Ian built this platform under the name "oliver_code." Finally, Cashio claimed it generated yield by staking these deposit derivatives in "Surya's" Sunny Aggregator and in Quarry, which Ian established under the name "Larry Jarry." The profits flowed into Cashio's treasury, managed by a decentralized autonomous organization (DAO).

Confused? Cashio's customers were too. CoinDesk asked two well-known users of Cashio to explain the app's complex process; neither could, as the relevant pages of the app provided no help.

What users cared about was this: Cashio's DeFi machine accepted their Saber LP tokens and spat out CASH tokens.

This was a profitable transaction. CASH holders could deposit their LP-backed stablecoins into Sunny's liquidity pool and earn returns of 10%-30%. One trader said that if they deposited Saber LP tokens into Sunny instead of Cashio, they would only earn 5%-10%. Both were backed by the same cryptocurrency assets, which did not matter.

This is the logic of DeFi monetary Legos.

The forced deposits from Saber to Cashio to Crate to Arrow to Sunny-or-Quarry had a greater impact on Saber. According to Ian, it turned $1 of TVL into $6. Many DeFi projects measure their TVL by boasting about the total amount of user deposits.

Ian wrote, "TVL can only be calculated when protocols are built separately," which explains why his anonymous protocols were built separately.

According to TVL tracker DeFiLlama, Saber’s deposits peaked at $4.15 billion on September 11, 2021; its SBR token peaked at 90 cents a few days earlier. Sunny Aggregator's TVL also peaked at $3.4 billion on September 11. Its SUNNY token had briefly reached an all-time high of 18 cents the day before.

According to data provider CoinGecko, both tokens plummeted by 99%. Saber and Sunny's TVL performed no better, as both dropped by over 96%.

Cashio Hacked

Cashio imploded on March 23 due to a $52 million hack, marking a significant backlash against Ship Capital.

Ian said in an unpublished blog that he "worked very hard to push people to put more money into Cashio," as he wrote its code. He apologized for their "catastrophic" losses in a protocol he created under a pseudonym and acknowledged under his real identity.

In an unpublished post, Ian pleaded with the hacker to return the funds. The hacker later did return $14 million of the $39 million requested by victims.

Ian wrote that if the hacker did not fully repay users, "I will do my best to repay affected individual users with my personal Saber and Sunny tokens. This will not cover the full amount, but it is all I can offer." However, he never fulfilled this promise.

Ian's First Code Submission Was on an EOS Project

Anonymity is common in cryptocurrency and is not in itself evidence of wrongdoing. Thirteen years after Bitcoin's debut, the true identity of its creator, Satoshi Nakamoto, remains unknown. And even after the recent brutal sell-off, this benchmark cryptocurrency still has a market cap of $442 billion.

Ian stated in an unpublished article, "I just want to focus on building and creating value in what I think is the best way to do things. I don't want to deal with too much criticism before my ideas are fully pushed to market, and anonymity is an easy way to keep myself (and the protocols I am involved with) at a distance from this."

According to records from Discord servers, Ian arrived at Solana in October 2020, but this was not his first coding experiment. His GitHub submission history dates back over a decade, with his first public cryptocurrency contribution being on an EOS project at the end of 2017.

In early January 2021, Ian discussed the tokenomics of a doomed stablecoin in the Discord of Basis.Cash. There, he became "obsessed" with building decentralized currency.

Along the way, he attempted to "build a multi-protocol DeFi ecosystem," but it ultimately ended in criticism and ridicule. Ian stated, "Moving to Solana was a way for me to reset."

Who Are the Anonymous Builders of Saber?

Who are the anonymous builders flocking to Saber? At a Solana conference in Lisbon last year, Ian addressed how Saber became the largest DeFi application on Solana in a panel titled "From Zero to $2 Billion."

Ian told Race Capital (Saber's largest venture capital backer), "We attracted some friends and were ready to build on top of Saber and develop the ecosystem."

One "friend's" project is Sunny. Another is the tokenized basket creation protocol Crate from Ian's alias kiwipepper. "Many of the friends they know," Ian stated. One of these friends built Cashio, a stablecoin project backed by Saber LP tokens that funneled liquidity into Sunny Aggregator. "We can promote CASH to bring more liquidity into Saber," he said.

In a brief interview with CoinDesk on Thursday, McCann said he was unaware of Ian's close relationship with Cashio.

"He always mentioned that there were others who created it, but I don't know who those others are, and I haven't met them."

Ian revealed the true origins of Cashio in an unpublished blog. As the code of 0xGhostchain, Ian was eager to complete a prototype of a Saber LP-backed stablecoin before Breakpoint (the largest developer gathering in Solana's ecosystem history). Ian hoped others could replicate Cashio. Every protocol relying on Saber LP tokens would become a liquidity spigot, funneling more TVL into the $1.7 billion mother ship.

"This is part of why the code is unsafe; it was rushed to meet this deadline," he wrote on March 26, just before a hacker deceived Cashio's unaudited smart contract with fake collateral, costing it $52 million.

Users in Cashio's Discord community might have believed the CASH code was safe. After all, Ian told them on November 23, "I personally audited it." However, on March 23, the day of the exploit, he stated to cryptocurrency Twitter, "I did not audit Cashio as carefully as I should have."

Both statements contradict what Ian wrote in his unpublished blog.

Continuing to Develop on Aptos

"Building projects under real names has always been our goal," Ian wrote in an unpublished blog.

On July 23, the brothers began soliciting external developers for Saber with a "DAO Accelerator Program." Its application form included: "How will your protocol deeply integrate with Saber to increase Saber’s quantity/TVL/capital efficiency?"

This effort coincided with the brothers' migration from Solana to the emerging blockchain Aptos, transplanting Saber onto them. One venture capitalist said many Solana developers were dragging their feet. Three sources said Ian was betting on this: they lead a venture capital firm based in Aptos. Their venture capital firm is named Protagonist. Its old name was "Ship Capital."

Seven users of the Saber ecosystem told CoinDesk they felt abandoned by the Macalinao brothers. Some CASH tokens lost value (previously stablecoins became worthless). Others said their cryptocurrency was trapped in the derivative tokens issued by Sunny. An anonymous user, BradGarlicBread, said he lost about $300,000 on Sunny and Saber — "Many people are worse off than I am."

The community believes Ian is orchestrating the situation, "but no one knows the real story," BradGarlicBread said. He is still trying to get Ian's attention. On July 16, Brad asked Ian if he could "pretend to be Surya for a day" to help investors of Sunny Aggregator recover their locked tokens. Ian skipped this question while answering others in Saber Discord.

Other SUNNY token holders asked Ian about the future plans for the yield aggregator: Is Saber moving to Aptos, and will Sunny do the same?

"Ian said on July 16, 'The main developer of Sunny lost most of his savings in the Cashio hack. He will 'encourage' this disheartened developer to rebuild Sunny in Move, which Ian said is a safer coding language than Solana's Rust for building protocols worth millions of dollars."

A week later, Ian said that this Sunny developer felt revitalized after trying Move.