FTX: while the platform collapses, another thief empties the wallets

On 11 November 2022, FTX applied for creditor protection. On the same evening, assets begin to leave their portfolios without authorization. Elliptic estimates stealth at about $477 million. This theft should not be confused with the misappropriation of funds that explains the collapse of the company.

In disorder, not all exits are necessarily criminal: the teams also seek to shelter reserves. Analysts must distinguish between addresses controlled by those responsible for bankruptcy and those of the thief. A sum that moves on the blockchain does not tell, alone, why it moves.

The stolen assets are quickly exchanged, especially to the ether. These conversions complicate the freezes: some tokens have an issuer capable of immobilizing an address, while other assets do not offer this leverage. Tokens are nevertheless blocked by their issuers and teams secure other reserves before they are taken away.

In 2024, a U.S. lawsuit described a group engaging in SIM card hijacking and a theft of more than 400 million against an unnamed company. Media are bringing this matter closer to FTX. The act consulted does not itself name the victim: this distinction must remain visible.

The mechanism described in this procedure is to divert a telephone number in order to obtain access or codes normally intended for its holder. It does not prove that each movement observed in FTX was carried out by the same person or by this means alone.

The extraordinary character of the case is also due to its timing. An organization that is already losing its bearings must simultaneously identify what is left and prevent someone else from winning.