Two Wrongs Don’t Make A Right

After the collapse of FTX, a hacker stole around $477 million worth of cryptocurrency from what was left of the rubble. The hacker has now been spotted moving their fraudulent funds.

• The hack occurred on the 11th of November, the same day that FTX filed for chapter 11 bankruptcy protection. On the 20th of November, the attacker transferred 50,000 ETH to separate wallets and converted it to Bitcoin using separate renBTC bridges. As of today, the hacker is the 40th largest holder of ETH.
• According to data from Etherscan, the attacker transferred 180,000 ETH across 12 freshly established wallets between 4:11 and 4:17 UTC on November 21. Each wallet received 15,000 ETH which at current pricing, totals around $199.3 million.
• Some in the crypto world believe that the attacker may be preparing to “peel chain” the stolen funds, or divide it up into smaller and smaller portions, to mislead investigators. It is likely that the hacker is also preparing to employ a mixing service, similar to the infamous Tornado Cash, at some point to hide their stolen funds.
• On Sunday 20th November, FTX’s official Twitter urged cryptocurrency exchanges to keep an eye out for the stolen funds before ending “exchanges should take all measures to secure these funds to be returned to the bankruptcy estate.“

As a result of bankruptcy, FTX owes its largest creditors around $3.1 billion, according to recent court filings. In other words, these stolen funds account for about 15% of what FTX owes its biggest clients alone.