Blockchain data from Etherscan shows that a crypto account associated with the FTX exploiter moved a total of 180,000 ether (ETH) – worth roughly $200 million at current prices – to 12 crypto wallets Monday, with each wallet receiving 15,000 ETH over a period of minutes.
Failed crypto exchange FTX suffered an exploit on Nov. 11 – the same day it filed for bankruptcy protection in the U.S. – enduring about $600 million of unauthorized withdrawals.
Blockchain experts argued that the looter was likely an insider who had access to the exchange's cold wallets. The security team of crypto exchange Kraken said that they knew the identity of the exploiter, because they used their personal verified account to pay for transaction fees.
Blockchain intelligence firm Arkham Intelligence said the FTX exploiter is in a panic, and has lost a substantial amount of money in slippage and conversion fees attempting to cash out.
The looter's move on Monday follows Sunday's conversion of funds to renBTC (a version of bitcoin on the Ren bridge). Ren is a blockchain bridge with close ties to Alameda Research, the corporate sibling of FTX. According to a report by blockchain analysis firm Elliptic, the Ren bridge has been previously used for laundering at least half a billion dollars of stolen funds.
The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is an award-winning media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. In November 2023, CoinDesk was acquired by Bullish group, owner of Bullish, a regulated, institutional digital assets exchange. Bullish group is majority owned by Block.one; both groups have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary, and an editorial committee, chaired by a former editor-in-chief of The Wall Street Journal, is being formed to support journalistic integrity.