Unknown actors moved more than $400 million from FTX wallets

In the morning of November 12, PeckShield experts noticed transfers totaling more than $400 million from FTX exchange wallets to external addresses.

#PeckShieldAlert Funds of multiple FTX wallets are flowing to 0x59AB…32b.
The address currently holds ~53,843.5 $ETH (~$69M) and ~$217.7M worth of other cryptos pic.twitter.com/FJWpGtiMPv

— PeckShieldAlert (@PeckShieldAlert) November 12, 2022

According to researchers, the recipient’s wallet already holds 53,843 ETH (around $69 million) and about $217 million in other cryptocurrencies.

Another 45.8 million FTT (over $105 million) were transferred to a wallet labeled “FTX” on Etherscan. PeckShield also noted its link to Binance.US, the American arm of the cryptocurrency exchange Binance.

#PeckShieldAlert The address 0xd801…969 seems like funded by Binance US
Smart contract 0x97f9…E5c is a multi-sig contract that allows multiple signers 0x5b63…3BD/0xC945…Fd3/0x8b41…E4A to review and agree on an action on the blockchain before it can be executed#safu? pic.twitter.com/mNHT5PZwxT

— PeckShieldAlert (@PeckShieldAlert) November 12, 2022

According to The Block, the administrator of FTX’s official Telegram channel wrote that the exchange had been hacked and all assets stolen. He later deleted the post, clarifying that a “part of the funds” had been stolen.

He also warned about the hack of the FTX mobile app and site, which could download malware and viruses onto users’ devices. At the time of writing, the channel and the exchange’s Telegram chat were unavailable.

The official FTX community administrator (not sure if he has resigned) spoke on the telegram community and pinned:
FTX has been hacked.
FTX apps are malware. Delete them.
Chat is open.
Don’t go on ftx site as it might download Trojans. pic.twitter.com/hQKkcGmsND

— Wu Blockchain (@WuBlockchain) November 12, 2022

The official FTX Twitter account retweeted a post by the platform’s chief counsel Ryne Miller. He wrote about “investigating anomalies with wallet movements related to the consolidation of FTX balances across exchanges.”

Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges — unclear facts as other movements not clear. Will share more info as soon as we have it. @FTX_Official

— Ryne Miller (@_Ryne_Miller) November 12, 2022

According to him, FTX US and FTX.com “initiated precautionary steps to move all digital assets to cold storage.” The process was expedited to mitigate damage after unauthorized transactions were observed.

Following the Chapter 11 bankruptcy filings — FTX US and FTX [dot] com initiated precautionary steps to move all digital assets to cold storage. Process was expedited this evening — to mitigate damage upon observing unauthorized transactions.

— Ryne Miller (@_Ryne_Miller) November 12, 2022

As a reminder, on November 6, Binance CEO Changpeng Zhao said he sought to shed the FTT utility token from the FTX exchange. Together with BUSD, assets totaling about $2.1 billion were the result of the company’s exit from its portfolio investment in the platform.

On November 8, CEO Sam Bankman-Fried and Zhao announced a strategic partnership, but on November 10 Binance declined to acquire. The company said it would not be able to resolve the issues facing the exchange.

According to Bloomberg and WSJ, the hole in FTX’s balance sheet stood at $8 billion. However Reuters cited a higher figure — $9.4 billion.

On November 11 FTX Group filed for Chapter 11 bankruptcy protection. Bankman-Fried resigned.

Read ForkLog’s bitcoin news on our Telegram — cryptocurrency news, prices and analysis.