A strange email was received yesterday by some FTX users from the FTX EU subsidiary. They are asked to fill in their personal information in order to withdraw their blocked funds from the platform. Let’s take a closer look at this email and how to react if you are affected.
An email sent by FTX EU
On Thursday, FTX users received an email from FTX EU informing them of a procedure to recover their blocked funds on the platform. If you are concerned, it is important that you have all the information in your hands before you act.
To begin, let’s quickly unfold the sequence of events. On November 12, 2022, the cryptocurrency exchange platform FTX suddenly collapsed, leaving hundreds of thousands of users unable to touch their assets. Since then, the firm has been under Chapter 11 bankruptcy protection and a team of lawyers is working on FTX’s recovery.
Nevertheless, the situation remained unchanged for users until yesterday. An email was sent to FTX EU customers, i.e. individuals who created an account on FTX after March 2022. Indeed, other users who registered their account before this date are dependent on FTX International.
Here are excerpts from this email, reported by the journalist Esprit Cryptique on Twitter:
The email in question was sent from the address support@ftxeurope.eu.
It was obviously sent only to people who are dependent on the FTX EU entity.
Only customers registered after March 2022 belong to this entity. The other Europeans belong to FTX International. pic.twitter.com/tcD4RTYVcf
– Esprit Cryptique (@_Cryptique) March 30, 2023
In addition to presenting the general context of the situation, this e-mail reminds us that FTX’s European subsidiary, FTX EU, was regulated by the Cyprus Securities and Exchange Commission (CySEC). This is presented as “having the highest standards of regulation in the European Union” and thus “FTX EU was operating independently of the international platform”.
According to the e-mail, this implies that “customer cash funds must be kept separately in legally protected bank accounts”. In other words, this would mean that FTX EU customer funds would not have been affected by Sam Bankman-Fried’s abuse. Furthermore, it is added that “to protect clients from further risks […] the positions were closed and converted to euros”.
A procedure asking for your password
After this e-mail, the user is directed to a website: ftxeurope.eu. The user is then asked to enter the email address and password used for their FTX account, verify their account, and upload their identification documents to validate the Know Your Customer (KYC) procedure. Finally, they can initiate the process of claiming the funds.
First of all, contrary to what may be conveyed in certain media, no withdrawals have been made at the time of writing. Indeed, the email explains: “you will be notified when your identity verification has been validated. This can take up to a month”.
Secondly, the website corresponds to a domain name that had been registered by FTX EU when it was registered with CySEC. However, it has been inactive for several months and FTX EU’s license has been suspended. Thus, it is possible that the site has been hacked and used for malicious purposes.
This e-mail was received the day after another e-mail from the entity in charge of the bankruptcy and recovery of FTX. This one informs the former users of the balance they had on the platform at the date of the closure of the services. It is not impossible that user data has fallen into the hands of malicious individuals.
Last but not least, according to the testimonies collected by Esprit Cryptique, some users who have carried out the procedure explained above see a wrong amount on their balance. Others explain that they have started a withdrawal procedure when the exchange was still active (still pending) and see a zero balance on the website
How to react if you are affected
We reported in February, FTX Japan has reintroduced withdrawal services for users of the platform. Like FTX EU, this platform was created at the beginning of 2022 as a result of a buyout and continued to evolve independently of FTX International. This is the reason why users were able to get their funds back.
Presumably – if the content of the e-mail is to be believed – the situation is similar for FTX EU. However, unlike the Japanese subsidiary, no official communication has been made by the European entity of the defunct exchange platform. A sign that is obviously not reassuring and invites all those concerned to exercise extreme caution, pending more information. Especially since if what is indicated in this e-mail is verified, the funds would be safe and there is no hurry to recover them.
The scenario of a malicious attack can obviously not be excluded at this time. The demand for your email address, password, as well as your documents to perform KYC procedures suggests that they could be used later by these individuals to retrieve the funds from your FTX account for you.
While all of this is speculation, caution is certainly the best choice here.
