TL;DR Breakdown<ul><li>FTX was hacked for about $600 million in cryptocurrency, shortly after filing for bankruptcy protection in the United States.</li><li>FTX attorneys said they had evidence that the Bahamian regulators ordered SBF to unauthorizedly transfer debtors’ funds to their custody.</li><li>However, on-chain information suggests there could be more to FTX’s mysterious attack, likely by someone close to the exchange.</li></ul>Hours after <a href="https://www.cryptopolitan.com/web-stories/why-is-ftx-bankrupt/" rel="noopener noreferrer nofollow">FTX declared bankruptcy</a>, about $600 million in different crypto tokens were unauthorisedly moved from the exchange’s accounts, the majority of which were confirmed to have been stolen by an unknown actor. While the exploit remains a mystery, reports and on-chain information tends to suggest that perpetrator could be someone close to the exchange – possibly, Sam Bankman-Fried (SBF).<h2 id="header-0">Who is behind the FTX accounts drainer wallet?</h2>In an <a href="https://pacer-documents.s3.amazonaws.com/33/188450/042120648186.pdf" rel="noopener noreferrer nofollow">emergency motion</a> filed on November 17th, FTX attorneys accused Sam Bankman-Fried and FTX co-founder Gary Wang of unauthorizedly moving funds from the bankrupt exchange, under the directive of the Bahamian regulator. The attorneys claimed to have evidence that the Bahamian regulators directed the “unauthorized access to the Debtors’ systems for the purpose of obtaining digital assets of the Debtors.”<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/a0cb96281fd649dc9c23ff743a7c19df.png" />The Securities Commission of The Bahamas did confirm it ordered the movement of some digital assets controlled by the local subsidiary of FTX exchange, <a href="https://www.cryptopolitan.com/ftx-europe-crypto-exchange-expands-to-europe/" rel="noopener noreferrer nofollow">FTX Digital Markets (FDM)</a>, to a separate address that the commission control. This happened on November 12th, a day after FTX’s bankruptcy declaration, but the commission explained that it had issued that emergency action for the safekeeping of the assets, and to protect the interest of all FDM clients and creditors.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/10a88f52312b4704a67399cd48d88ca5.png" />While it’s uncertain whether the funds moved by the SBF and the Bahamian regulator are part of the larger $600 million stolen from FTX, on-chain information suggests it’s probably not, given the sophisticated medium with which the stolen cryptocurrencies are being moved across blockchains. But what remains apparent is that FTX’s exploitation could be an “insider job.”Lookonchain detected coordination in the trading pattern between FTX’s hacker address, currently flagged as “FTX Accounts Drainer” on Etherscan, and one other <a href="https://www.cryptopolitan.com/news/ethereum-eth/" rel="noopener noreferrer nofollow">Ethereum</a> address “0xd275,” which was involved in misappropriating user funds, as confirmed by a former Senior Engineer at FTX, Vydamo.Two days before FTX suspended withdrawals, 0xd275 started conducting large-scale ETH transfers on-chain, which according to Lookonchain, never occurred since the creation of the address. “The time coincides with the time when the FTX exchange suspended user withdrawals,” the on-chain research platform said.What fascinates the most is the correlation between the addresses. 0xd275 would transfer funds to exchanges – probably to short ETH –  some minutes before FTX Accounts Drainers dumped ETH.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/7efcd66e70f343fc841222e751b0c572.png" /><blockquote>LookonchainThe transaction time of 0xd275 is very consistent with FTX Accounts Drainer, it seems that the same person is operating. When 0xd275 stops trading, FTX Accounts Drainer starts trading; and when FTX Accounts Drainer stops trading, 0xd275 resumes trading.</blockquote>This coincidence suggests the hacker or someone knowledgeable about the activities of the FTX Accounts Drainer could also be in control of 0xd275, which has already been vouched to be a property of someone close to FTX. As such, it’s plausible that anyone from FTX – it could be SBF – might have drained funds from the exchange.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/8c52d3df2d4147e9a5a0bffe9d99aa4b.png" /><h2 id="header-1">FTX hacker is trying to launder funds</h2>FTX was drained on both Ethereum and <a href="https://www.binance.com/en/markets?ref&#61;16863683" rel="noopener noreferrer nofollow">Binance</a> networks. In multiple transactions, all the stolen cryptocurrencies were swapped through decentralized protocols to Ether (ETH) contained in the main Ethereum wallet. After several conversions and asset bridges, the address accumulated about 288k ETH, making the hacker the 35th largest Ethereum holder then.<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/ff8902f9580c4555b56f39290aa0ae92.png" />But in recent days, the hackers have begun bridging the stolen Ether again, but to the Bitcoin <a href="https://www.cryptopolitan.com/news/blockchain/" rel="noopener noreferrer nofollow">blockchain</a>, in what is believed to be a laundering attempt. Precisely on November 20th, the FTX Accounts Drainer moved 50k ETH to a unique address 0x866E, which was later swapped for renBTC and bridged to Bitcoin.One of the BTC addresses – “Bc1qv…gpedg” – that received bridged Bitcoins from the FTX hacker, started a peel chain shortly after receiving the funds. According to CertiK, a peel chain “is a money laundering technique whereby BTC is sent through a series of transactions in which smaller amounts of BTC are transferred to a new address.”<img src="https://academy-public.coinmarketcap.com/srd-optimized-uploads/257865583e074d35bab6799cec4e9454.png" />Most recently on Monday, the hacker transferred 180k ETH to 12 new Ethereum addresses, and each address currently holds 15k ETH. The FTX Accounts Drainer wallet only has 5,735 ETH (or $6.2 million) left. Speculations are that hackers could be attempting to bridge the coins to Bitcoin blockchain for another peel chain.

Is SBF the FTX funds drainer?

Table of Contents

Cryptopolitan_News

Other articles published on Nov 22, 2022

ApolloX x BNB Chain $3,000 Football Fiesta: World Cup 2022 Prediction Challenge

Buenbit users access Everyday DeFi through RIF Product Suite built on Rootstock

Metaverse Marketing Conference MMC2022 will be held by 'Contents Korea 2022'

Water Must Be Saved- KSN Token

DeFi Yield Farming Explained

Biswap Collectibles Release | The Long Awaited Limited NFT Collection!

Join our free newsletter for daily crypto updates!