Hacker Behind $400 Million FTX Theft Could Exploit Sam Bankman-Fried Trial Hype, Warns CertiK Director

The individual responsible for the massive $400 million theft from FTX and FTX.US in November might be leveraging the attention surrounding Sam Bankman-Fried’s fraud trial to obscure the stolen funds, according to a warning from Hugh Brooks, Director of Security Operations at CertiK.

In the days leading up to Bankman-Fried’s criminal trial, the hacker, known as “FTX Drainer,” initiated a series of transfers involving millions in Ether (ETH) that were obtained during the November attack.

These transfers have continued during the trial, with approximately 15,000 ETH, equivalent to roughly $24 million, being moved to three new wallet addresses within the last three days.

Brooks suggested that the increased scrutiny from the FTX trial spurred the hacker to hide the stolen assets more urgently. It’s also possible that the hacker believed the prosecution would divert enough attention from the Web3 community, making it difficult to track the stolen funds while simultaneously covering the trial.

FTX, once valued at $32 billion, filed for bankruptcy on November 11. On the same day, FTX employees noticed substantial fund withdrawals from the exchange’s wallets.

A recent report by Wired shed light on the night of the attack. Seeing the attacker’s access to multiple wallets, the FTX team acted swiftly to prevent further fund control by the hacker.

They moved $400-500 million to a private Ledger cold wallet, awaiting BitGo’s post-bankruptcy asset management guidance. This strategic move likely thwarted the attacker’s attempts to seize an additional $1 billion.

Furthermore, the hacker has adjusted their tactics for concealing the stolen assets. On November 21, they attempted to launder the funds using a “peel chain” technique, sending decreasing sums to new wallets.

They have since adopted a more complex method. This new method spreads the stolen Bitcoin across multiple wallets, each holding smaller portions of the pilfered assets. This method significantly extends the time required to trace the funds.

Hugh Brooks stated that the FTX hack investigation is ongoing, with no identified individuals or groups linked to the theft.