FTX Hack
ESTIMATED THEFT
$477.0M
What happened
During November 11–12, 2022, FTX wallets suffered unauthorized transfers as the exchange entered bankruptcy. Elliptic estimated $477 million stolen, distinct from assets moved defensively and the wider bankruptcy shortfall. Later reporting linked the theft to a SIM-swapping case; the exact role of each accused person remained unclear in Elliptic’s February 2024 account.
Technical Root Cause
The later investigation linked the wallet theft to SIM swapping. The reviewed evidence does not establish a smart-contract exploit or the precise role of every accused participant.
Case & protocol details
Classification
Wallet Security
How it happened
- Unauthorized transfers removed assets from FTX wallets over several hours. FTX staff and advisers separately moved assets to safety.
- The stolen tokens were exchanged for native assets and moved between chains. Elliptic traced BSC and Solana assets toward Ethereum and later transfers toward Bitcoin.
- Tether froze $31.5 million in stolen USDT. Frozen assets and trading losses reduced the attacker’s holdings, but are not equivalent to customer reimbursement.
- A later SIM-swapping indictment concerned access associated with the incident; Elliptic reported the connection while distinguishing access facilitation from control of the stolen funds.
Evidence & learning
Sources and on-chain records
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
