The individual behind the 2022 attack on FTX has altered their strategy for laundering their stolen Ethereum into Bitcoin.
On-chain analyst Lookonchain noticed on Oct. 6 that the person behind last year’s FTX hack had stopped using THORChain for moving their stolen assets and had begun to exploit the Threshold Network instead.
Lookonchain’s data indicated that the attacker converted over 3,000 Ether (ETH), valued at $4.9 million, into tBTC via the Threshold network. Since then, per Lookonchain, the attacker has successfully converted about 75,636 ETH, valued at $124 million, into Bitcoin, while another 109,485 ETH, valued at approximately $180 million, remains in their wallet.
After @THORSwap suspended swaps, FTX Exploiter started swapping $ETH for $tBTC and cross-chained to the Bitcoin network through @TheTNetwork.So far, FTX Exploiter has swapped 75,636 $ETH($124M) for BTC assets and cross-chained to the Bitcoin network. pic.twitter.com/ksIPBzRJ0d
— Lookonchain (@lookonchain) October 6, 2023
Threshold is a decentralized conduit between the Bitcoin (BTC) and Ethereum blockchains that allows users to convert their holdings into an ERC-20 token, tBTC, pegged 1:1 with Bitcoin.
You might also like: FTX hacker moves $4.2m worth of ETH after months of inactivity
According to reports, the attacker had previously preferred THORSwap, but it entered maintenance mode on Oct. 6 in order to stop any additional potential illegal activities.
Fellow THORChads,A pressing and persistent concern has recently come to light: the potential movement of illicit funds through THORChain and, specifically, THORSwap. Such activities have no place on the THORSwap platform, and THORSwap stands firmly against any and all criminal…
— THORSwap ⚡ #BetterThanCEX (@THORSwap) October 6, 2023
The decision reportedly came after extensive internal discussions and advice from legal and law enforcement entities, and the platform will remain on hold until a robust safety solution can be established.
Before THORChain went into maintenance, the FTX exploiter had reportedly moved at least $38 million worth of ETH through it and the privacy-protecting platform, Railgun.
FTX Accounts Drainer transferred 7,500 $ETH($12.62M) out again 1 hour ago.The FTX Accounts Drainer has transferred 22,500 $ETH($38M) out in the past 2 days and currently has 163,235 $ETH($275M) left.https://t.co/YMSdqrSTxZ pic.twitter.com/dL6K47zC3n
— Lookonchain (@lookonchain) October 1, 2023
Originally, damage estimates from the hack were thought to be up to $400 million, but FTX reassessed the situation and reported losses closer to $323 million.
The identity of the culprit behind the attack is still shrouded in uncertainty, but speculation within the crypto community pointed fingers at the controversial FTX founder Sam Bankman-Fried, who is currently on trial for wire fraud and conspiracy to commit money laundering.
While Bankman-Fried has adamantly refuted claims of his involvement in the theft, the significant movement of stolen funds coinciding with his trial has reignited speculation of an insider’s involvement.
Read more: What to expect when FTX founder Sam Bankman-Fried’s trial resumes for day 5