Update: The US Department of Justice has now confirmed that FTX was the victim of the SIM swap attack that resulted in the theft of $400 million in cryptoassets. On November 11, 2022 $477 million was stolen from cryptoasset exchange FTX, just as it was collapsing into bankruptcy. Elliptic has been following these stolen assets as they have been laundered over the intervening years. A report from Brian Krebs now suggests that three individuals have been indicted in relation to this heist. Last week, three individuals were named in an indictment, alleged to be members of a SIM swapping ring involved in facilitating the theft of “over $400 million” in virtual currency from a business on November 11 and 12, 2022:
In the case of the FTX hack, the attacker began to transfer cryptoassets from FTX's wallets beginning on the evening of November 11, 2022 local time and continuing until November 12.
Elliptic's analysis puts the value of the cryptoassets stolen from FTX at $477 million, and we are not aware of any other thefts from crypto businesses on this scale, on these dates. It therefore appears likely that FTX is the “Victim Company-1” named in the indictment.
Elliptic has been following the assets stolen from FTX in the years since the November 2022 hack, tracing them through mixers, cross-chain bridges, decentralised exchanges and other services.
A screenshot from EllipticInvestigator,showing the stolen assets being converted to ETH through decentralized exchanges, then being bridged to Bitcoin and sent through ChipMixer.
Just last week, cryptoassets stolen from FTX worth tens of million dollars began to move once again, having been dormant for several months.
It is not clear whether the three indicted individuals are alleged to have been involved in the theft of the cryptoassets and their subsequent laundering, or only in facilitating the initial access to the victim company's online accounts. It is therefore not clear whether any of the stolen assets are under their control, and might be recovered.
