Millions in Ether Tied to FTX ‘Hacker’ on The Move

Around 2,500 ether (ETH), worth just over $4 million, tied to last year’s apparent exploit of the FTX exchange started moving early Saturday, blockchain data shows.

Ether held in a wallet associated with the FTX accounts drainer began moving for the first time in nearly a year. The funds were split into two, and then a few times in subsequent transactions, with 700 ETH transferred using the Thorchain Router, about 1,200 ETH being moved through the Railgun privacy tool. Another 550 ETH is sitting in an intermediate wallet.

Railgun is a privacy wallet that lets users store tokens and use funds for decentralized financial services, such as lending and borrowing. These transactions are shielded, meaning the exact use of such funds is not known. On the other hand, Thorchain is a bridge that lets users swap tokens between different blockchains.

There is still 12,500 ETH (worth around $21 million at current prices) sitting in the original wallet.

Accounts tied to FTX and FTX US were drained on Nov. 11, 2022, mere hours after the company filed for bankruptcy and founder Sam Bankman-Fried resigned from the crypto empire he ran. The attacker took over $600 million worth of ether at the time. In a since-deleted tweet, the then FTX general counsel Ryne Miller said the exchange was taking “precautionary steps” to secure funds from other FTX wallets.

John J. Ray III, the CEO and Chief Restructuring Officer of the FTX Debtors, which handles the FTX bankruptcy proceedings, later said that $323 million in various tokens were hacked from its international exchange and $90m from its US platform, as per reports.

The attacker(s) who made off with the funds was(were) never identified. Some 21,500 ETH, worth $27 million at the time, were converted into the stablecoin DAI a few days after the hack. Another 288,000 ETH remained in some of the addresses affiliated with the attacker.

Saturday’s transactions come days before Bankman-Fried goes on trial in the U.S. over fraud and conspiracy to commit fraud charges filed by federal prosecutors last December. Bankman-Fried has pleaded not guilty to all charges, though other former FTX and Alameda Research executives have pleaded guilty; some are expected to testify against their former boss.

UPDATE (Sept. 29, 13:42 UTC): An earlier version incorrectly said the THORChain protocol masks addresses.