The "multi-role player" who once fabricated 70% of Solana's TVL is now turning attention to Aptos
TechFlow Selected TechFlow Selected
The "multi-role player" who once fabricated 70% of Solana's TVL is now turning attention to Aptos
75% of Solana's TVL was once faked by a single individual, spanning 11 projects. Sunny and Saber briefly reached $7.5 billion in TVL (with double-counting). Now he has abandoned Solana and wants to do the same thing on Aptos.
Navigating Web3 tides with focused insightsBy Danny Nelson & Tracy Wang
Translation: Shiwen | ODaily Planet Daily Contributor
For crypto user Saint Eclectic, something about Sunny Aggregator—a DeFi aggregator on Solana—felt off.
Sunny’s native token surged fivefold during last summer’s bull market. By early September, just two weeks after its launch, billions of dollars in cryptocurrency had flooded into the yield farm.
Yet Saint and others had questions: Who was behind Sunny? Why was the developer using the pseudonym “Surya Khosla”? Had its codebase been audited? Was users’ money safe?
"There was no indication of who Surya was," Saint recalled recently. "A lot of users felt uneasy putting their crypto into it."
Their suspicions were justified. CoinDesk has learned that Surya’s real name is Ian Macalinao, chief designer at Sabre—the stablecoin exchange on Solana—and that he built Sunny Aggregator atop Sabre.
The 20-something computer expert from Texas operated under 11 separate developer identities, creating a sprawling network of DeFi protocols that projected billions of dollars in double-counted value into the Saber ecosystem. Last November, as this network raced toward its peak, it briefly inflated Solana’s total value locked (TVL)—a metric often seen by loyal DeFi users as a barometer of on-chain activity.
"I designed a scheme to maximize Solana's TVL: I would build protocols that stack on each other so $1 could be counted multiple times," Ian wrote in an unpublished blog post reviewed by CoinDesk. The post was prepared on March 26, three days after one of the secretly built protocols, Cashio, lost $52 million in a hack.
Sources familiar with the matter confirmed the authenticity of the content.
Peak Performance
Ian’s strategy worked—for a while. According to his own figures, Sabre and Sunny once accounted for $7.5 billion of Solana’s $10.5 billion TVL peak. (Billions were double-counted across his two protocols.)
"I believe it contributed to SOL’s price increase," Ian wrote when SOL was trading at $188.
According to data provider DeFiLlama, even as the Sabre ecosystem began losing momentum in mid-September 2021, Solana’s network-wide TVL continued to swell, peaking around $15 billion on November 9—by which time Sabre’s TVL had already dropped 64%.
Ian wrote that he disdained such "vanity metrics"; though he was bothered that "Ethereum’s TVL is much higher than Solana’s," since in his view, Ethereum’s DeFi projects are also "stacked" and deposit values repeatedly counted.
"I wanted to create a system very similar to this," he wrote. One problem: "If every protocol is built by the same team, TVL as a metric becomes even more absurd. So I created additional anonymous personas," he said.
Ian wore 11 masks.
In public, Ian and his brother Dylan referred to their anonymous roles as “friends” or “friends of friends.” Their "Ship Capital" programmer club was “mapping out the blueprint for my ideal DeFi ecosystem,” Ian wrote in the unpublished blog. Saber and its LP tokens formed the foundation.
"If an ecosystem appears to be built by just a few people, it seems less authentic," Ian wrote in the blog. "I wanted it to look like many people were building our protocols, not 20 unrelated programs run by one person."
Ian hoped other crypto protocols would rely on Saber to the point where "its failure could bring down the entire system," Dylan said on October 1, 2021. "This was Saber Labs’ strategy, but few understood it…"
As of publication, the Macalinao brothers declined to comment.
“Sybil Attack”
Using anonymity may be justifiable. But "anonymous" Ian launched a Sybil attack, abusing crypto users’ trust. (A Sybil attack occurs when a single entity uses fake identities to gain disproportionate influence over a network.)
"I’m revealing this because I know I’ll eventually be caught," Ian wrote in his unpublished blog.
Yet in May, Ian released “Sabre Public Goods,” spreading the “Sabre team’s” prolific code across Solana. Eight of Ian’s 11 secret projects appeared there. But no disclosure was made about the anonymity.
“My Anonymous Army”
Ian created Sunny Aggregator under the name Surya Khosla and launched a Twitter account in August 2021. Sunny skeptic Saint Eclectic hesitated to deposit his LP tokens into a project led by a mysterious figure represented by an AI-generated face.
One factor favored Surya: Ian’s puppet claimed to “know in real life” the Dylan brothers. On September 9, Dylan Macalinao tweeted: “I feel comfortable putting my crypto into Sunny Aggregator,” adding, “We audited their code.”
Dylan gave Surya the credibility needed to win over skeptics like Saint Eclectic.
The problem? Lead developer “Surya Khosla” didn’t exist. Dylan’s older brother Ian built Sunny Aggregator. Ian invented Surya.
This was Ian’s first use of a false identity for Saber—and far from his last.
Ian wrote in March 2022 that he had created 11 “anonymous founders”—all fabricated by himself.
According to Ian’s blog, he admitted creating lesser-known protocols such as Crate (run by kiwipepper), aSOL (0xAurelion), Arrow (oliver_code), Traction.Market (0xIsaacNewton), Sencha (jjmatcha), and Venko App (ayyakovenko)—DeFi Legos that became jewels of the Saber ecosystem.
Behavior Among Anons
Ian, Dylan, and their puppet anons constantly promoted Ship Capital’s work on social media. They praised each other’s projects and continuously encouraged and celebrated builders’ achievements.
On December 29, Solana developer Armani Ferrante (real person) tweeted: “If you aren’t making mistakes, you’re going too slow,” and five of Ian’s puppets responded within four minutes:
@_kiwipepper replied: “As @simplyianm says, it’s an experiment!”—one of them herself.
Others wavered in the face of facts.
We cannot confirm whether these tweets were manipulated by Ian behind the scenes. But two people who previously collaborated with Ship Capital recalled strange team behaviors: one character’s Telegram account would go online right after another logged off.
Regardless, Ian stated in his unpublished article: "If you're a developer, it's easy to spot which open-source protocols I wrote: they always have a 'flake.nix' file—something only I use."
CoinDesk verified that many projects described in Ian’s blog contain the "flake.nix" file.
Starting with Cashio
To understand how the “army of anons” injected multiply counted value into Saber, 0xGhostchain’s Cashio project offers a compelling case.
Cashio’s CASH debuted in November last year near the market peak, branded as a “decentralized stablecoin” whose dollar-pegged crypto was backed by “liquidity provider” tokens.
Cashio accepted only Saber’s LP tokens as collateral. This wasn’t unusual in November, when Saber was a $1B+ TVL “automated market maker” and the primary DeFi trading venue for stablecoin pairs on Solana.
Cashio relied on Saber ecosystem projects created by Ian’s anonymous personas to generate yield.
It first used Crate to wrap Saber LP tokens into “tokenized baskets”—a process built by Ian under the alias “kiwipepper.” It then routed these “baskets” through Arrow, a yield-redirection platform built by Ian as “oliver_code.” Finally, Cashio claimed it earned returns by staking these derivative deposits in “Surya’s” Sunny Aggregator and Quarry—built by Ian under the name “Larry Jarry.” Profits flowed to Cashio’s treasury, managed by a decentralized autonomous organization (DAO).
Confused? So were Cashio’s customers. CoinDesk asked two prominent Cashio users to explain the app’s complex process; neither could, as the app’s documentation offered little help.
What users cared about: Cashio’s DeFi machine took their Saber LP tokens and spat out CASH tokens.
It was a profitable deal. CASH holders could deposit their LP-backed stablecoins into Sunny liquidity pools and earn 10%-30% returns. One trader said depositing Saber LP tokens directly into Sunny instead of Cashio would yield only 5%-10%. Both were backed by the same underlying crypto assets—it didn’t matter.
This is the logic of DeFi money Lego.
Forced deposits from Saber to Cashio to Crate to Arrow to Sunny or Quarry amplified impact on Saber. According to Ian, it turned $1 of TVL into $6. Many DeFi projects measure TVL by inflating total user deposits.
Ian wrote: "TVL should only be counted if protocols are built independently"—explaining why his anon protocols were set up separately.
According to TVL tracker DeFiLlama, Saber’s deposits peaked at $4.15 billion on September 11, 2021; its SBR token hit a high of 90 cents days earlier. Sunny Aggregator’s TVL also peaked on September 11 at $3.4 billion. Its SUNNY token briefly reached an all-time high of 18 cents the day before.
According to data provider CoinGecko, both tokens crashed 99%. Saber and Sunny’s TVL fared little better, each falling over 96%.
Cashio Hacked
Cashio imploded on March 23 due to a $52 million hack—a major blow to Ship Capital.
Ian said in the unpublished blog that he "worked hard to push people to put more funds into Cashio" because he wrote its code. He apologized in a protocol he created under a pseudonym and endorsed under his real identity for their "catastrophic" losses.
In the unpublished post, Ian pleaded with the hacker to return the funds. The hacker later returned $14 million of the $39 million victims requested.
Ian wrote that if the hacker didn’t fully repay users, "I will do everything I can to personally reimburse affected individuals using my Saber and Sunny tokens. It won’t cover the full amount, but it’s all I can offer." Yet he never fulfilled this promise.
Ian’s First Code Commit Was on an EOS Project
Anonymity is common in crypto and not inherently evidence of wrongdoing. More than 13 years after Bitcoin’s debut, its creator Satoshi Nakamoto remains unknown. And despite a recent brutal selloff, this “crypto progenitor” still commands a $442 billion market cap.
Ian wrote in an unpublished article: "I just want to focus on building and creating value in what I believe is the best way. I don’t want to deal with excessive criticism before my ideas are fully brought to market, and anonymity is a simple way to distance myself (and the protocols I work on) from that."
According to Discord server logs, Ian arrived on Solana in October 2020—but this wasn’t his first coding experiment. His GitHub commit history dates back over a decade, with his first public crypto contribution on an EOS project in late 2017.
In early January 2021, Ian discussed tokenomics of a doomed stablecoin in Basis.Cash’s Discord. There, he began to become "obsessed" with building decentralized money.
Along the way, he tried to "build a multi-protocol DeFi ecosystem," but ended up facing criticism and ridicule. "Moving to Solana was my way of restarting," Ian said.
Who Were Saber’s Anonymous Builders?
Who were these anonymous builders flocking to Saber? At a Solana conference in Lisbon, Portugal, last year, Ian spoke on a panel titled “From Zero to $2 Billion” about how Saber became Solana’s largest DeFi app.
Ian told Race Capital (Saber’s largest venture backer): "We attracted some friends who planned to build on Saber and grow the ecosystem."
One “friend’s” project was Sunny. Another was Crate, the tokenized basket protocol built by Ian under the alias kiwipepper. “Many friends we know,” Ian said. One of these friends built Cashio, a stablecoin project backed by Saber LP tokens, feeding liquidity into Sunny Aggregator. "We can promote CASH to bring more liquidity into Saber," he said.
In a brief interview with CoinDesk on Thursday, McCann said he didn’t know about Ian’s close ties to Cashio.
"He always mentioned others created it, but I didn’t know who those others were, and I’ve never met them."
Ian revealed Cashio’s true origin in his unpublished blog. As 0xGhostchain’s code, Ian rushed to complete a Saber LP-backed stablecoin model before Breakpoint—the largest developer gathering in Solana’s history. Ian hoped others would replicate Cashio. Every protocol relying on Saber LP tokens would become a liquidity spigot, pumping more TVL into the $1.7 billion flagship.
"That’s partly why the code wasn’t secure—it was hastily completed for this deadline," he wrote on March 26, after a hacker exploited Cashio’s unaudited smart contract with fake collateral, draining $52 million.
Users in Cashio’s Discord community might have believed the CASH code was safe. After all, Ian told them on November 23: "I personally reviewed it." Yet on March 23—the day of the exploit—he told crypto Twitter: "I didn’t review Cashio as carefully as I should have."
Both statements contradict what Ian wrote in his unpublished blog.
Moving Forward to Aptos
"Building projects under our real names has always been our goal," Ian wrote in the unpublished blog.
On July 23, the brothers launched a “DAO accelerator program” to recruit external developers to Saber. The application asked: "How will your protocol deeply integrate with Saber to increase Saber’s volume/TVL/capital efficiency?"
This effort coincided with the brothers’ move from Solana to the emerging blockchain Aptos, porting Saber to Aptos. Three sources said Ian is betting big: they lead a venture firm based on Aptos called Protagonist—formerly known as 'Ship Capital'.
Seven Sabre ecosystem users told CoinDesk they felt abandoned by the Macalinao brothers. Some suffered CASH token losses (the former stablecoin fell to zero). Others said their crypto was trapped in derivative tokens issued by Sunny. Anonymous user Brad_Garlic_Bread said he lost around $300,000 on Sunny and Sabre—"plenty of people had it worse."
The community believed Ian was calling the shots, "but no one knew the truth," said Brad_Garlic_Bread. He’s still trying to get Ian’s attention. On July 16, Brad asked Ian if he could "pretend to be Surya for one day" to help Sunny Aggregator investors recover locked tokens. Ian skipped the question while answering others in Saber Discord.
Other SUNNY token holders asked Ian about future plans for the yield aggregator: Saber is migrating to Aptos—will Sunny follow?
"The main developer of Sunny lost most of his savings in the Cashio hack," Ian said on July 16. He would "encourage" the disillusioned developer to rebuild Sunny in Move (Aptos’ programming language), which Ian said is safer than Solana’s Rust for building million-dollar protocols.
A week later, Ian said the Sunny developer felt reinvigorated after trying Move.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
