The Fake Team That Made Solana DeFi Look Huge

We already knew that crypto developers cannot always be trusted. But can we even trust the data?

AccessTimeIconAug 5, 2022 at 5:25 p.m. UTC
Updated May 11, 2023 at 5:03 p.m. UTC
Layer 2
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

CoinDesk reporters Danny Nelson and Tracy Wang on Thursday released a bombshell report that could tarnish the reputation of the entire Solana ecosystem. More than that, the dizzying tale highlights serious social vulnerabilities across blockchain and crypto development and investing.

At the center of the story is a network of 11 developers who collaborated on a complex web of decentralized finance (DeFi) services based around a Solana stablecoin exchange called Saber. The developers, with names including Surya Khosla, Larry Jarry, 0xGhostchain and Goki Rajesh, succeeded in creating trading and staking services that attracted a claimed $7.5 billion in deposits, known as “TVL” or total value locked.

This article is excerpted from The Node, CoinDesk's daily roundup of the most pivotal stories in blockchain and crypto news. You can subscribe to get the full newsletter here.

Nelson and Wang have discovered, however, that those developers were not real people. Instead, they and others were aliases of just two men, the brothers Dylan and Ian Macalinao. CoinDesk’s reporters gained access to a blog post that was written by Ian Macalinao as a seeming confession to the long con. The post was never published.

That $7.5 billion in deposits made up the lion’s share of all the money tallied on Solana services in early fall of 2021, when the chain’s DeFi deposits totaled roughly $10.5 billion. TVL is often taken as a measure of success for smart-contract services or platforms, and Solana’s sizable deposits helped bolster its claim to be an up-and-coming competitor to the Ethereum blockchain.

That narrative, in turn, had a substantial role in driving the Solana token price from under $40 in July of last year to a peak of $259 in November 2021. A significant portion of the bullish Solana narrative now seems to have been based on a series of deceptions.


The developer personas weren’t all that was fake. The Macalinao brothers’ operation with Saber was seemingly undertaken with explicitly deceptive intent: “I devised a scheme to maximize Solana’s TVL: I would build protocols that stack on top of each other, such that a dollar could be counted several times,” Ian Macalinao wrote in the unpublished blog post.

Though there’s much still unknown, what may be most striking about the scheme is that it’s not clear its goal was theft. The Macalinao brothers do not appear, for instance, to have used their swarm of false identities as a shield while mishandling user funds, as is all too common in such scenarios (though, again, this story is still developing).

The greater share of harm to users of the Saber ecosystem of services seems to have instead resulted from the hack of an app called Cashio seemingly created by the Macalinao brothers. Further, users have now seemingly been abandoned, with the Macalinaos announcing they’re shifting focus to new projects on the upstart Aptos blockchain.

The fault in our stats

The staggering case highlights at least two serious specific vulnerabilities in the DeFi and crypto ecosystems, and some much larger thorny questions. First, it reignites the perpetual issue of anonymous developers in the crypto space. Bitcoin founding developer Satoshi Nakamoto remains pseudonymous, and there are many good reasons blockchain devs may wish to protect their real names.

But that norm also adds to the risk of a high-speed, high-stakes environment. Even a pseudonym can be trustworthy if they’re a known entity with their own track record, but it’s clear that standard isn’t being consistently followed by DeFi speculators. As Nelson and Wang’s reporting shows, the Macalinaos were able to bolster the reputations of their various identities simply by orchestrating fake Twitter conversations and having them trade endorsements.

The second discrete issue is the use of TVL, or total value locked, as a key metric in DeFi. The Macalinao story highlights both that the metric can be technically manipulated, in this case through counting assets multiple times across services that look distinct, but aren’t. This may be fixable, as top DeFi data service DefiLlama is making changes to prevent similar attempts to game metrics.

But there’s a broader, more complex issue that is going to be much harder to tackle. What the Saber story reveals is that less than a handful of people with dishonest intentions can profoundly distort cryptocurrency markets. The Macalinao brothers’ scheme created huge false signals about the value of Solana, which is still a top-10 crypto asset at this writing.

“I believe it contributed to the dramatic rise of SOL,” Ian Macalinao wrote about the token in the unpublished post. (Personally, I dipped my toes into SOL last summer, but after seeing one too many chain pauses I sold my position for a loss and no longer hold the token.)

We’ve seen even more troubling failures and deceptions in recent months from the likes of Terra/LUNA, Three Arrows Capital and centralized lenders like Celsius Network. But those were, if nothing else, genuinely sprawling operations backed up by large messaging efforts and the appearance of seriousness.

That two twentysomethings in Texas could accomplish anything remotely comparable with nothing more than a series of carefully-managed fake Twitter profiles should be an even stronger reminder of the huge risks that seem, at least for now, inherent to cryptocurrency.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

David Z. Morris

David Z. Morris was CoinDesk's Chief Insights Columnist. He holds Bitcoin, Ethereum, and small amounts of other crypto assets.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.