A day after FTX filed for chapter 11 bankruptcy, the firm’s wallets were drained for hundreds of millions of dollars in a late-night Friday attack.
In a 2am tweet, FTX US General Counsel Ryne Mille confirmed that some transactions were “unauthorized” and said that the company is moving the remaining assets to “mitigate the damage.”
According to blockchain analytics platform Elliptic, around $633 million was transferred in various tokens on Avalanche, Ethereum, and Binance Smart Chain. Of this, about $477 million is believed to be unauthorized transactions, while the remaining was moved to secured cold wallet storage by FTX themselves.
A reuters report claimed that FTX’s founder Sam Bankman-Fried (SBF) transferred about $10 billion of customer funds from the exchange through a backdoor to his trading company Alameda Research, with around $1.7 billion still missing.
However, no connection of that to the hack could be established.
BlackHat seems like 0x59 & 6sek1 (~$450m?)
— ZachXBT (@zachxbt) November 12, 2022
Whitehat seems like 0x97 & 0xd8
(~$196m)
Not sure about 6b4ay ($1.6b if counting illiquid tokens like MAPS OXY etc.)
As the funds were being drained in real time, some theories from the community indicated that it might be an insider job from the FTX leadership to safeguard their own funds.
Hundreds of millions of dollars are now flowing out of FTX wallets, some speculate liquidators but it's late on a friday night, not typical times for such rapid heavy movements. Some withdrawals are being swapped from Tether to DAI. Hack or insider actions? $26 million here pic.twitter.com/8wWlaE7na9
— foobar (@0xfoobar) November 12, 2022
somebody sent an onchain message to the recipient account with 4byte selector `0x3d24a1ff`, which is the hash of function name "Rug Pull All"
— foobar (@0xfoobar) November 12, 2022
great stuff pic.twitter.com/3w3rOaRTAJ
“FTX apps are malware. Delete them. Chat is open. Don’t go on ftx site as it might download Trojans,” posted Rey, an FTX administrator, on Telegram.
Despite the confirmations from FTX, the community seemed to be divided on the hack.
if you think FTX is being hacked right now, you should consider quitting crypto. you are too kind and gullible for this industry,
— scott (@scott_lew_is) November 12, 2022
Milner provided another update amidst the chaos, suggesting FTX continues to follow chapter 11 obligations.
1/ Statement from John Ray, Chief Restructuring Officer and CEO of @FTX_Official — Consistent with their obligations as Chapter 11 Debtors-in-Possession, FTX US and FTX [dot] com continue to make every effort to secure all assets, wherever located.
— Ryne Miller (@_Ryne_Miller) November 12, 2022
“We have been in contact with, and are coordinating with law enforcement and relevant regulators,” stated John Ray, Chief Restructuring Officer and the new CEO of FTX.
If this was indeed an exploit, it will go down as one of this year’s biggest hacks.