Fresh attack: Hacker plunders $120 million off FTX

As the trial of FTX founder Sam Bankman-Fried unfolds, reminders of the exchange’s major hack in 2022 loom. Anonymous hackers behind the breach have emerged again, moving stolen assets from FTX. In this amount includes a significant amount of Ether (ETH).

This comes as a report from blockchain analytics firm Elliptic. The firm noted that approximately 72,500 Ether has moved from the exchange (which is in operations now) signalling the first movement of assets on the exchange since the hack last November.

From the data, the hacker seems to have converted the stolen ETH into Bitcoin (BTC) through decentralised exchange THORSwap. These transactions were made just a few days before the former founder’s trial commenced last week.

This technique to convert the funds from one cryptocurrency to another mirrors the method used during the initial hack. In 2022, the hacker converted 65,000 ETH into Bitcoin using the RenBridge cross-chain bridge. Since the attack, $300 million worth of ETH has sat dormant on the platform until the first signs of movement took place during the early hours of September 30, 2023. The identity of the thief still remains anonymous, but Elliptic suggests three potential culprits. The suspect an FTX insider, North Korea’s Lazarus Group, or Russia-linked criminal organisation might have been at play with these attacks.

“Some FTX employees would have had access to the business’s crypto assets in order to move them for operational reasons. In the chaos surrounding the company’s bankruptcy and collapse, it may have been possible for an internal actor to take these asset.”

Elliptic’s report also revealed that despite the hacker’s successful attacks, in the days following the initial attack, they lost $94 million in their frantic attempts to launder the stolen assets. The report speculates that the chaos surrounding FTX’s bankruptcy and collapse may have provided an opportunity for an internal actor to make off with the assets.