FTX hack — November 2022

Over the night of 11-12 November 2022 UTC, hours after FTX Trading Ltd. filed for Chapter 11 bankruptcy, cryptoassets began leaving wallets controlled by FTX and FTX US without authorisation. Remaining staff warned users over Telegram not to visit the site or install app updates while the drain was in progress.

A federal indictment returned in January 2024 in the District of Columbia describes the mechanism. Prosecutors say Emily Hernandez used a fraudulent identity document carrying an FTX employee's details and her own photograph to impersonate that employee at a mobile phone store in Texas, which gave Robert Powell access to the employee's AT&T account. Co-conspirators then relayed authentication codes to Powell, who used them to reach the company's online accounts and transfer out over $400 million in virtual currency. The indictment identifies the victim only by a placeholder and does not name FTX; the identification rests on the timing and amounts reported by journalists, not on any Justice Department statement.

The figures differ by source and have never been reconciled. Elliptic, tracking the wallets as they emptied, valued the outflow at $477 million. The FTX debtors' January 2023 recovery presentation put unauthorised third-party transfers at $323 million from FTX.com and $90 million from FTX US, $413 million in total; Reuters reported the total as about $415 million. The indictment says 'over $400 million'.

Most of the stolen tokens were swapped for ETH on decentralised exchanges within hours. Roughly $100 million of USDT and PAXG was frozen by Tether and Paxos. From 20 November the ETH was converted to renBTC and bridged to Bitcoin via RenBridge. Emily Hernandez pleaded guilty on 16 May 2024; the disposition of the cases against Powell and Rohn is not established here.