FTX wallets were on the move late Friday night, the same day that FTX and its related companies filed for Chapter 11 bankruptcy. And it looked too early, too late at night and too sophisticated for the actions to be attributed to liquidators.
Several wallets allegedly belonging to FTX were drained of hundreds of millions of dollars in coins, with funds transferred from Tether (USDT) to stablecoin DAI and from staked Ethereum (stETH) to Ethereum (ETH).
The exodus totals around $650 million, according to an estimate from blockchain scout ZachXBT.
Blockchain developer and auditor Foobar noticed the first transfer of $26 million and issued an alert at 9:47 PM EST.
As the movement continued in real time – all traceable on Etherscan – Crypto Twitter erupted in theories. Was it a hack, or an inside job by FTX management who looked after their own funds, directly disobeying the bankruptcy proceedings?
“Hundreds of millions of dollars now flowing out of FTX wallets. Some are speculating liquidators, but it’s late on a Friday night, not typical times for such quick heavy moves,” Foobar tweeted.
“Several former FTX employees confirmed to me that they do not recognize these transfers,” ZachXBT tweeted at 10:48 PM EST.
According to the blockchain tracking website DeBank, $280,726,364 in ETH, $99,276,088 in BNB and $3,970,099 in AVAX were sent to one of the receiving wallets.
The drainage continued.
At 11:08 PM EST, FTX US Attorney General Ryne Miller tweeted“Investigating wallet movement abnormalities related to consolidation of ftx balances across exchanges.” As crypto experts on Twitter surmised, Miller would have been informed if the funds were moved as part of the liquidation process.
Just before midnight, an FTX Telegram admin named Rey wrote: “Ftx has been hacked. All funds appear to be gone.” FTX apps are malware. Delete them. The chat is open. Don’t go on the ftx side as it might download trojans.”
In cybersecurity, Trojans (named after the Trojan horse in Greek mythology) are programs that claim to perform one function but actually perform another, typically malicious. Trojans can take the form of attachments, downloads and fake videos.
But many onlookers didn’t buy the idea that this was a hack.
“If you think FTX is getting hacked right now, you should consider quitting crypto. You are too kind and gullible for this industry,” DeFi Pulse founder Scott Lewis tweeted.
Twitter “Chief Twit” Elon Musk took the opportunity to point out that all the action took place on Twitter.
It took until 02:07 EST for Ryne Miller to come up with another update. He claimed that earlier on Friday, FTX and FTX US had “initiated precautionary steps to move all digital assets to cold storage” and that “the process was accelerated this evening to reduce damage from observing unauthorized transactions.”
On Thursday, the securities commission in the Bahamas, where FTX is headquartered, ordered FTX’s assets were frozen and a liquidator assigned to the company.
So far, $3 billion in crypto has been stolen in 2022 through 125 different hacks, according to Chain analysis.
Once the dust settles from the FTX drain, if it really was a hack, this number will surpass the previous record of $3.2 billion set last year.
Stay up to date on crypto news, get daily updates in your inbox.
