FTX Hacker Moves Coins

The hacker or insider who stole hundreds of millions of dollars in crypto while FTX was imploding back in November 2022 has been moving funds. It may or may not be a coincidence that the trial of Sam Bankman-Fried also began this week.

The Final Days Of FTX

On November 11, 2022, FTX—at the time, the second largest crypto exchange in the world—was in the process of collapsing. Users were desperately trying to withdraw funds as the state of the exchange became clear. A block on withdrawals would be imminent, customers knew, and at that point their funds might be lost forever.

Then the news hit: FTX had filed for Chapter 11 bankruptcy. It was over. FTX, once the guiding light for the crypto world, had fallen.

Taking Advantage Of The Chaos

But in the pandemonium of that day, those watching the drama unfold on-chain noticed some suspicious transactions. Addresses controlled by FTX and its US branch, FTX.US, were drained of $600 million in crypto.

Was it a hacker who decided to take advantage of the fact that the exchange was imploding, and figured this would be the best and last opportunity to make a killing? Was it a trusted team member with access to the wallets? Or perhaps it was even SBF himself, who realized the game was up and he needed to plan for the future?

These things have a way of coming out eventually. It's very hard to launder such huge sums successfully. As yet, though, it's unclear who was responsible.

Funds Move

Starting on September 30, the hacker started moving crypto from some of the addresses it had been illegally withdrawn to, having patiently waited for almost a year.

The first transfer was for over 10,000 ETH, and has been followed over the past week by additional transactions totalling around $100 million. The hacker used a number of different DeFi protocols to move ETH and convert it to Bitcoin without risking having the funds frozen.

Is The Timing A Coincidence?

SBF's trial on fraud and money laundering charges began on Tuesday. It's interesting that the hacker should start moving the stolen crypto at this time.

There has been much speculation that the hack itself was an inside job. FTX was in crisis, it was clear there was no coming back, many of its employees knew they would face prosecution, they knew the accounting processes were practically non-existent, they were in a position of trust and had access to those accounts, and the confusion made it the perfect opportunity.

It's interesting, then, that the first transactions out of those wallets have occurred just as SBF is going to trial. Is this the hacker somehow seeking to suggest that the former CEO was responsible? Or a team member looking to fund their defense—or a new life far from anything to do with FTX?

Subscribe to our newsletter and follow us on Twitter.