We do not build for today. But apparently, we do build under aliases.
On a September afternoon, Austin Chen — co-founder of Manifund, a nonprofit regranting platform organized around AI safety and effective altruism — confirmed that Caroline Ellison, former Alameda Research CEO and the central cooperating witness in the FTX prosecution, had been working on Manifund's funding platform. She was not listed. She was not introduced. She worked as "Carol."
That single detail — the alias — is the entire disclosure. Everything else is a press release.
I have spent my career reading code for what it hides rather than what it claims. The same discipline applies here. A system that changes its interface to dodge public scrutiny has already published its threat model. The name "Carol" is not a privacy feature. It is a risk-mitigation patch applied to a governance surface before anyone else could find the bug.
Manifund is not a protocol. It is not a token. On the evidence available, it is not a smart contract at all — no disclosed blockchain stack, no on-chain treasury, no token distribution. It is a nonprofit charitable organization focused on AI safety and effective altruism funding, and Ellison's role, per reporting, is to develop its funding platform. "Funding," in this context, most plausibly means charitable fundraising and regranting — routing donor capital to sub-grantmakers — not any decentralized finance product.
The human context outweighs the architecture. Ellison pled guilty in December 2022 to fraud and conspiracy. She testified against Sam Bankman-Fried as the government's core witness. She received a two-year sentence and, per reporting, is expected to be released around January 2026. Austin Chen's public framing: she has admitted error, is assisting creditor repayment, and is serving her sentence.
That is the entire factual substrate. No code, no chain, no market data. Which is exactly why the technical auditor should keep reading. Infrastructure is not only silicon and storage. Governance is infrastructure. Disclosure is infrastructure. Auditing them requires the identical discipline.
Let me apply the framework I would apply to a multi-sig library.
First, the disclosure mechanism. Ellison worked under an alias; Chen later confirmed the identity publicly. Two phases — anonymous operation, then attributed endorsement. Reentrancy doesn't announce itself; it hides in the ordering of state transitions. Here, the ordering was anonymous-first, accountable-second. That is a state change executed before observers could price it in. If governance transparency is a property of the system, this system exhibited a deliberate opacity window. That is a design choice, not an accident. The alias predates the confirmation, and the sequencing tells you the operator anticipated a political reaction and engineered a buffer against it.
Second, the timeline. A person described as "currently serving her sentence" is also described as developing a platform. Those facts are not impossible together — work-release and supervised-release programs exist — but the report never establishes which arrangement applies, and it never fixes the year. The tension is not evidence of wrongdoing. It is evidence of an incomplete record. When I audited the Parity multi-sig library, the flaw was never in the headline function; it was in the ordering of ownership updates during nested calls. Here, the ordering — conviction, cooperation, release, employment — is the thing to verify, not the thing to assume.
Third, the cooperation-credit signal. Ellison's compressed exposure is a live demonstration of how the American system prices insider cooperation. For crypto professionals, this is not trivia. It is a behavioral incentive encoded into enforcement: assist, and the penalty shortens. That incentive reshapes future cases at the margin. The most consequential output of this event is not a hiring decision; it is a deterrence parameter.
The reflexive read is that this is a legal or reputational story. I would narrow it.
The legal exposure is thin. Employing a convicted person in a nonprofit role is not, by itself, unlawful. The reputational exposure is where the real surface area sits, and it is asymmetric: Manifund has assumed a known-triggering association that strikes at its core asset — donor trust. That is a strange trade. A funding platform's only durable collateral is the willingness of donors to route capital through it without asking whether the routing serves the mission or the operator's rehabilitation.
Here is the counterintuitive angle. The loudest critique — that EA is sheltering its own — is the wrong-shaped critique. The sharper observation is structural. Ellison did not fail as a person first; Alameda failed as a system. The art is the hash; the value is the proof. A risk engine that cannot survive its own operator's optimism is not a risk engine — it is a narrative. The relevant question is not whether someone deserves a second chance. It is whether the infrastructure they now touch carries independent verification, or whether it again rests on trust in a single human. Regranting platforms are exactly where that question is hardest, because their "proof" is a transfer of custody, not a cryptographic commitment. I recall arguing for years that most compliance is theater — the cost lands on honest users while the determined route around it. This hire lands in the same gap: no cryptographic receipt, only a story.
Watch the ledger, not the apology. Follow Manifund's disclosed donation flows. Track whether supervised-release conditions constrain the employment in practice. Track whether the FTX circle's reentry becomes a pattern — because a pattern, unlike a single hire, invites the regulator's scrutiny. The fashionable line says everyone deserves a second chance. Perhaps. But a network verifies only what it can independently confirm. Everything else is a name we have chosen to believe.
s scrutiny.