The alleged hacker behind the theft of hundreds of millions of dollars from the bankrupt cryptocurrency exchange FTX is moving the funds around to separate wallets to try and evade tracking, according to data from Etherscan. 

See related article: FTX owes US$3.1 billion to top 50 unnamed creditors, court filing shows

Fast facts

  • Over Monday night, the wallet FTX Accounts Drainer sent 15,000 ETH (over US$16 million) each to 12 new on-chain addresses. Some crypto analysts suggest the attacker is attempting to divide the loot into smaller amounts to elude investigators in a process known as “peel chaining.”
  • Chainalysis warned Sunday that the hacker may also intend to send his funds to a crypto mixer. Crypto mixers are used by privacy advocates, but are also the favored tool of cybercriminals to obscure the origins of illicit cryptocurrency.  
  • The new FTX Chief Restructuring Officer, John Ray, said in a statement that the amount stolen from the hacker is over US$372 million. 
  • Some reports put the figure at more than US$600 million, but other analysts have pointed out a conflation between the hack and funds taken out of FTX’s exchange by the Bahamian government for security reasons.  
  • The funds were drained from FTX on Nov. 11, the same day that FTX filed for chapter 11 bankruptcy.  
  • Last week, the ex-CEO of FTX, Sam Bankman-Fried, told Vox news that the hacker likely was, or had access to, an ex-employee or their computer. 

See related article: FTX Japan readies for resumption of withdrawals by end-2022: report