Millions in Ether Tied to FTX 'Hacker' on The Move

FTX was hacked in November 2022, hours after the global crypto empire declared bankruptcy and its founder Sam Bankman-Fried stepped down from running the company.

AccessTimeIconSep 30, 2023 at 7:35 a.m. UTC
Updated Oct 2, 2023 at 3:08 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Around 2,500 ether (ETH), worth just over $4 million, tied to last year’s apparent exploit of the FTX exchange started moving early Saturday, blockchain data shows.

Ether held in a wallet associated with the FTX accounts drainer began moving for the first time in nearly a year. The funds were split into two, and then a few times in subsequent transactions, with 700 ETH transferred using the Thorchain Router, about 1,200 ETH being moved through the Railgun privacy tool. Another 550 ETH is sitting in an intermediate wallet.

Railgun is a privacy wallet that lets users store tokens and use funds for decentralized financial services, such as lending and borrowing. These transactions are shielded, meaning the exact use of such funds is not known. On the other hand, Thorchain is a bridge that lets users swap tokens between different blockchains.

There is still 12,500 ETH (worth around $21 million at current prices) sitting in the original wallet.

Accounts tied to FTX and FTX US were drained on Nov. 11, 2022, mere hours after the company filed for bankruptcy and founder Sam Bankman-Fried resigned from the crypto empire he ran. The attacker took over $600 million worth of ether at the time. In a since-deleted tweet, the then FTX general counsel Ryne Miller said the exchange was taking “precautionary steps” to secure funds from other FTX wallets.

John J. Ray III, the CEO and Chief Restructuring Officer of the FTX Debtors, which handles the FTX bankruptcy proceedings, later said that $323 million in various tokens were hacked from its international exchange and $90m from its US platform, as per reports.

The attacker(s) who made off with the funds was(were) never identified. Some 21,500 ETH, worth $27 million at the time, were converted into the stablecoin DAI a few days after the hack. Another 288,000 ETH remained in some of the addresses affiliated with the attacker.

Saturday’s transactions come days before Bankman-Fried goes on trial in the U.S. over fraud and conspiracy to commit fraud charges filed by federal prosecutors last December. Bankman-Fried has pleaded not guilty to all charges, though other former FTX and Alameda Research executives have pleaded guilty; some are expected to testify against their former boss.

UPDATE (Sept. 29, 13:42 UTC): An earlier version incorrectly said the THORChain protocol masks addresses.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Shaurya Malwa

Shaurya is the Deputy Managing Editor for the Data & Tokens team, focusing on decentralized finance, markets, on-chain data, and governance across all major and minor blockchains.

Nikhilesh De

Nikhilesh De is CoinDesk's managing editor for global policy and regulation. He owns marginal amounts of bitcoin and ether.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.