This tweet thread by head of R&D at Coin metrics has a good hypothesis:

https://mobile.twitter.com/LucasNuzzi/status/159012259020682...

In summary:

1. Alameda essentially needed a bailout in the spring.

2. Alameda, though, also had a large chunk of FTT coming due in the fall that was basically part of the vesting schedule of the original FTT ICO.

3. So, FTX lent Alameda customer funds in the spring.

4. In the fall, when the vested FTT paid out to Alameda, they immediately paid it back to FTX.

5. The thing that looks highly suspicious and fraudulent is that SBF tweeted out that the big FTT move that day was just normal "rotation".

Also, particularly interesting to me, the FTX-US president, Brett Harrison, resigned the day before that transaction at the end of September. He also just liked an interview on LinkedIn where Brian Armstrong (Coinbase CEO) was being interviewed, saying "not all crypto companies are like FTX, where it appears they fraudulently misappropriated customer funds".

The above is speculation, but it's based on on-chain data.