FTX exploiter converts another $25M worth of ETH to BTC, total up to $100M

The FTX exploiter converted another $25 million worth of stolen Ethereum (ETH) to Bitcoin (BTC) on Oct. 4 over two transactions amounting to 5,625 ETH and 9,375 ETH, respectively, based on Spot On Chain’s data.

The transactions occurred with a gap of roughly eight hours, with the tokens converted to BTC through THORChain Router — a bridge protocol to Bitcoin.

The address in question still holds $208.481 in various cryptocurrencies, with more than 95% held in Ethereum.

No longer dormant

The FTX exploiter, who had been almost entirely dormant almost the entirety of the 10 months since the hack took place, suddenly began converting millions of dollars worth of ETH to BTC on Sept. 30.

Since then, the hacker has converted over $100 million of the stolen ETH  token to BTC over 12 transactions split over six days.

The timing of these significant fund movements coincides with the beginning of FTX founder Sam Bankman-Fried’s court trial, stirring speculation about a potential insider’s role in the massive hack that transpired in January 2023.

The initial transaction amounts on the first day were kept relatively low, ranging from a low of 1,250 ETH to 2,500 ETH. However, on Oct. 2, the exploiter executed a transaction amounting to 4,500 ETH. Following that, most of the transaction amounts grew to 7,500 each.

Before the Oct. 4 transactions, the exploiter moved 30,000 ETH on Oct. 2 and 3 in four tranches of 7,500 ETH each. The tokens were converted to BTC through THORChain and Railgun.

The Initial Breach

On Nov. 11, 2022, accounts related to both FTX and FTX US were emptied just hours after FTX declared bankruptcy. The event occurred shortly after the company’s founder, SBF, announced his departure from the global crypto empire.

At the time of the hack, the attacker seized over $600 million in ETH.

Following the breach, around 2,500 ETH, valued at a little over $4 million, were seen moving. The funds were initially divided in half and further split in subsequent operations:

• 700 ETH was transferred using the Thorchain Router.
• 1,200 ETH was channeled through the Railgun privacy tool, which shields transaction details.
• 550 ETH was left in a transitional wallet.
• Additionally, 12,500 ETH, estimated to be worth about $21 million, remained in the originating wallet.

John J. Ray III, who took charge as the CEO and Chief Restructuring Officer overseeing FTX’s bankruptcy proceedings, later reported that the hack resulted in a loss of $323 million in varied tokens from FTX’s international exchange. The U.S. platform separately lost $90 million.

The identity of the hacker — or hackers — remains a mystery. Some 21,500 ETH, valued at $27 million during the incident, was exchanged for the stablecoin DAI shortly after the intrusion.

Additionally, 288,000 ETH continued to be held in addresses linked with the hacker — a vast chunk of it now converted to Bitcoin and moved to unknown addresses.