As the Sam Bankman-Fried trial gets underway tomorrow, the FTX hacker has moved over $50 million in the space of 3 days, after more than 10 months of inactivity on the wallets concerned. How does the individual go about it, and where do the funds concerned, transferred in the form of Ethers (ETH), end up?
FTX attacker continues to move funds
On Saturday morning, the individual who carried out the $350 million-plus hack on the evening of FTX’s bankruptcy had transferred $25 million after ten months of total inactivity on the wallets concerned. The attacker had moved this sum in the form of Ethers through various wallets before sending it to the Railgun confidentiality protocol, the Thorchain bridge and the Ethereum burn address.
As we can see below, the individual appears to be acting methodically, moving only part of the funds address by address. Whereas he had moved his $25 million exclusively from the 0x3E9 wallet (in blue), this time he moved more than $25 million from another wallet (0xTF3, in red):
However, the finality seems to be the same for all the ETH transferred by the hacker, i.e. they end up on the Thorchain bridge before being transferred to numerous other wallets. In total, the hacker moved over $51 million in just under 3 days.
At the time of writing, the individual still holds $275 million across various wallets, almost exclusively in the form of Ethers. Almost a year later, we still don’t know the identity of the person or persons who carried out the attack on FTX.
However, since the funds were transferred from wallets belonging to FTX and others to FTX US, a separate branch, many suspected insider trading. At the time, Sam Bankman-Fried stated that these actions had probably been committed by a former exchange employee.
It is also interesting to note that these sudden movements began only a few days before Sam Bankman-Fried’s trial was due to begin. The trial is due to start tomorrow, and is expected to finish on Thursday November 9