{"id":206614,"date":"2022-11-16T13:40:32","date_gmt":"2022-11-16T12:40:32","guid":{"rendered":"http:\/\/sftarticles.wpenginepowered.com\/en\/?p=206614"},"modified":"2025-07-01T20:20:23","modified_gmt":"2025-07-02T03:20:23","slug":"following-the-stolen-ftx-money","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/following-the-stolen-ftx-money\/","title":{"rendered":"Blockchain investigations: Following the stolen FTX money"},"content":{"rendered":"\n<p>It has been a rocky week for crypto with <strong>the collapse of FTX<\/strong>, a major crypto exchange, seemingly wiping billions of the combined net worth of legions of crypto enthusiasts. We\u2019re not talking here about the <strong>volatility of the crypto markets<\/strong> either even though the price of <a href=\"https:\/\/en.softonic.com\/articles\/will-bitcoin-see-the-light-again\" target=\"_blank\" rel=\"noreferrer noopener\">Bitcoin<\/a> crashed to new yearly lows and has been up and down since. Instead, the real headlines have come from billions of dollars\u2019 worth of FTX user deposits simply not being there anymore. In total, it looks as though <strong>close to $8 billion worth of crypto assets were essentially worthless <\/strong>as the company did not have the funds needed to pay out their value. On top of that, <strong>hackers were able to walk away with almost half a billion dollars<\/strong>. This article will try to unpick the chaos and look at how investigators are trying to get the money back and catch the people who stole it.<\/p>\n\n\n\n<p>Following a Twitter exchange between FTX head honcho Sam Bankman-Fried and Changpeng Zhao, CEO of rival crypto exchange <a href=\"https:\/\/binance.en.softonic.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">Binance<\/a>, FTX users began frantically trying to withdraw their funds from the exchange, <strong>attempting to take around $6 billion worth of funds over a 24-hour period<\/strong>. This was a full-scale bank run that ended in FTX filing for bankruptcy and leaving so many users without access to their assets.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A deeper look at FTX<\/h2>\n\n\n\n<p>Back in its heyday Bankman-Fried\u2019s FTX was seen as a prodigious company and he and his company were regularly compared to entrepreneurial luminaries such as J.P. Morgan or Warren Buffet. Behind the scenes, however, <strong><a href=\"https:\/\/ftx-pro-trade-crypto.en.softonic.com\/\" target=\"_blank\" rel=\"noreferrer noopener\">FTX<\/a> was not run like other companies<\/strong>. For a start, despite venture capitalist firms investing billions of dollars into the company they did not have representatives on the board.<\/p>\n\n\n\n<p>It is no wonder that things have gone so badly wrong when you further examine the corporate structure at FTX. As well as working without the oversight of a board of investors, <strong>the FTX top team were all living together in a penthouse in the Bahamas<\/strong> with several reports claiming that they were all i<strong>n romantic relationships with each other<\/strong>. If you add to this the rather austere image that Bankman-Fried and his team portrayed to the world while living in a penthouse that has just gone on the market for just under $40 million the <strong>dysfunction and dishonesty<\/strong> that will come to mark FTX quickly becomes apparent.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Who&#39;s buying SBF&#39;s penthouse in The Bahamas? ??<br><br>Just listed. $39,500,000 &amp; it&#39;s yours. <a href=\"https:\/\/t.co\/IH2X34pvFi\">pic.twitter.com\/IH2X34pvFi<\/a><\/p>&mdash; Altcoin Daily (@AltcoinDailyio) <a href=\"https:\/\/twitter.com\/AltcoinDailyio\/status\/1591935068762968065?ref_src=twsrc%5Etfw\">November 13, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">How FTX failed<\/h2>\n\n\n\n<p>This leads to <strong>what ultimately caused FTX to fail<\/strong>, which was the <strong>mishandling of user deposits<\/strong> in misguided attempts to invest in companies and future endeavors. Bankman-Fried founded Alameda Research in 2017 before founding FTX a couple of years later. <strong>Alameda Research was a trading firm<\/strong>, investing in crypto projects and flipping the investments for profit. Once FTX had been founded, however, <strong>the close proximity between the trading firm and the exchange began to raise eyebrows<\/strong>, due to Alameda often profiting from the losses FTX customers were experiencing. According to the <a href=\"https:\/\/www.nytimes.com\/2022\/11\/14\/technology\/ftx-sam-bankman-fried-crypto-bankruptcy.html\" target=\"_blank\" rel=\"noreferrer noopener\">New York Times<\/a>, although both companies were supposed to be separate entities, <strong>Alameda employees often had a full view of the FTX trading data<\/strong> when teams from both companies were working out of the Bahamas penthouse.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">JUST IN: Alameda Research purchased crypto tokens before listing them on FTX, WSJ reports.<\/p>&mdash; Watcher.Guru (@WatcherGuru) <a href=\"https:\/\/twitter.com\/WatcherGuru\/status\/1592211390005379074?ref_src=twsrc%5Etfw\">November 14, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The links between the two firms sit at the heart of the recent <a href=\"https:\/\/en.softonic.com\/s\/crypto\" target=\"_blank\" rel=\"noreferrer noopener\">crypto<\/a> crash as loans made by Alameda to cover bad investments proved difficult to pay off as the cash was not readily available. In an attempt to plug this gap, <strong>the firm began using FTX user deposits to pay off the loans<\/strong>. Reports say that this amounted to <strong>a staggering $10 billion worth of FTX deposits<\/strong> being used to cover Alameda loans, an amount which the exchange simply could not cover.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The FTX hack<\/h2>\n\n\n\n<p>This brings us to the hack. Incredibly, on top of the billions of dollars of misappropriated funds squandered on bad investments, <strong>hackers were also able to steal almost half a billion dollars from FTX<\/strong> as the company was collapsing. Naturally, considering the dishonest and dysfunctional environment of the FTX head office\/penthouse, suspicions have quickly turned to FTX insiders. It is still not exactly clear how the hack was perpetrated against the ailing crypto exchange but fortunately, <strong>due to the nature of <a href=\"https:\/\/en.softonic.com\/s\/blockchain\" target=\"_blank\" rel=\"noreferrer noopener\">blockchains<\/a>, following the money is easy to do<\/strong> and even if the transactions are made anonymously, at the end of the day, turning the anonymous crypto coins into spendable currency will get people\u2019s attention.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How investigators are tracking the stolen money<\/h2>\n\n\n\n<p><strong>Blockchains work like centralized ledgers<\/strong>. Transactions and contract executions are computed and added to blocks and then added to the chain. The <strong>chain cannot then be altered only added to<\/strong> meaning that the transactions are all transparent and remain public forever. This means that <strong>crypto coins stolen in the hack can be tracked<\/strong> whenever somebody interacts with a blockchain to move them around. This means, that as <a href=\"https:\/\/www.wired.com\/story\/ftx-hack-theft-crypto-tracing\" target=\"_blank\" rel=\"noreferrer noopener\">Wired<\/a> has reported, crypto investigators have been able to <strong>follow the cash<\/strong>, which crypto-tracing company TRM Labs values at around $338 million <strong>to a mere handful of crypto wallet addresses<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">Our current estimate of unauthorized withdrawals from FTX is $338mm. <br><br>As previously reported, some withdrawals are to FTX cold storage wallets. Our $338mm figure excludes clean funds under the control of FTX Group.<br><br>We\u2019re monitoring the situation closely.<a href=\"https:\/\/twitter.com\/hashtag\/FTX?src=hash&amp;ref_src=twsrc%5Etfw\">#FTX<\/a>  <a href=\"https:\/\/twitter.com\/hashtag\/ftxwithdrawal?src=hash&amp;ref_src=twsrc%5Etfw\">#ftxwithdrawal<\/a> <a href=\"https:\/\/t.co\/TmpMmIw5uV\">pic.twitter.com\/TmpMmIw5uV<\/a><\/p>&mdash; TRM Labs (@trmlabs) <a href=\"https:\/\/twitter.com\/trmlabs\/status\/1591561707285270533?ref_src=twsrc%5Etfw\">November 12, 2022<\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>The result of this observability is that it b<strong>ecomes very difficult for the hackers to actually spend the cash<\/strong>. As head of investigations at TRM Labs, Chris Janczewski said to Wired:<\/p>\n\n\n\n<p><em>\u201cThis potential thief has hundreds of millions of dollars. But it&#8217;s like they went into a bank, took as much cash as they could carry, and then the dye packs went off. They&#8217;ve got all this money, but now everyone knows it&#8217;s connected to this bank robbery. What can you actually do with it?\u201d<\/em><\/p>\n\n\n\n<p>All this leaves the thieves in a tricky situation as any time they try to access or spend the cash they have stolen from FTX, they <strong>put their identities at risk<\/strong>. Identities that may well be linked to team members at FTX itself. However, it is worth pointing out, however, that although people seeing their fortunes evaporate before their eyes may seem like the perfect culprits for a heist of this magnitude, they could also be more <a href=\"https:\/\/metamask.en.softonic.com\/articles\/phishing-pop-ups-crypto-websites\" target=\"_blank\" rel=\"noreferrer noopener\">susceptible to scams<\/a>. We report regularly on <a href=\"https:\/\/en.softonic.com\/articles\/b\/phishing\" target=\"_blank\" rel=\"noreferrer noopener\">advanced phishing scams<\/a> designed to take advantage of internet users and trick them into clicking on a link they shouldn\u2019t or downloading an infected file. There is a good chance that <strong>the scammer may have taken advantage of the chaos of FTX\u2019s fall <\/strong>to get a team member to do something they shouldn\u2019t have.<\/p>\n\n\n<div class=\"sc-card-program\">\r\n  <div class=\"sc-card-program__body\">\r\n    <div class=\"sc-card-program__row clearfix\">\r\n      <div class=\"sc-card-program__col-logo\">\r\n        <img decoding=\"async\" class=\"sc-card-program__img\" alt=\"How to spot a phishing scam\" src=\"https:\/\/articles-img.sftcdn.net\/sft\/articles\/auto-mapping-folder\/sites\/3\/2022\/11\/phishing-scam.jpg\" width=\"100px\" height=\"100px\">\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-title\">\r\n        <span class=\"sc-card-program__title\">How to spot a phishing scam<\/span>\r\n        <a class=\"sc-card-program__button sc-card-program-internal\" href=\"https:\/\/en.softonic.com\/articles\/how-to-detect-fakescam-emails-and-avoid-phishing-attacks-hi-res-version\" target=\"_self\" rel=\"noopener noreferrer\">Learn more<\/a>\r\n      <\/div>\r\n      <div class=\"sc-card-program__col-rating\">\r\n        <svg class=\"rating-score__content\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" version=\"1.1\" x=\"0\" y=\"0\" viewbox=\"0 0 50 50\" enable-background=\"new 0 0 50 50\" xml:space=\"preserve\"><path class=\"rating-score__background rating-score--good\" fill=\"none\" stroke-width=\"6\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><path class=\"rating-score__value rating-score__value--0\" fill=\"none\" stroke-width=\"6\" stroke-dashoffset=\"0\" stroke-miterlimit=\"10\" d=\"M40 40c8.3-8.3 8.3-21.7 0-30s-21.7-8.3-30 0 -8.3 21.7 0 30\"><\/path><text class=\"rating-score__number\" content=\"\" text-anchor=\"middle\" transform=\"matrix(1 0 0 1 25 31.0837)\" data-auto=\"app-user-score\"><\/text><\/svg>\r\n      <\/div>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <span class=\"sc-card-program__description\"><\/span>\r\n    <\/div>\r\n    <div class=\"sc-card-program__row\">\r\n      <img decoding=\"async\" class=\"sc-card-program__bigpic\" src=\"\" onerror=\"this.style.display='none'\">\r\n    <\/div>\r\n    <a class=\"sc-card-program__link track-link sc-card-program-internal\" href=\"https:\/\/en.softonic.com\/articles\/how-to-detect-fakescam-emails-and-avoid-phishing-attacks-hi-res-version\" target=\"_self\" rel=\"noopener noreferrer\"><\/a>\r\n  <\/div>\r\n<\/div>\n\n\n\n<p>Whoever perpetrated the FTX hack, whether it was an internal team member, or an external hacker will likely face challenges getting the stolen money out into the real world as crypto investigators are watching the money closely. On top of the hack, however, <strong>thoughts must also go out to the unsuspecting FTX users who have seen their funds disappear<\/strong> through malfeasance and dishonest business practices.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It has been a rocky week for crypto with the collapse of FTX, a major crypto exchange, seemingly wiping billions of the combined net worth of legions of crypto enthusiasts. We\u2019re not talking here about the volatility of the crypto markets either even though the price of Bitcoin crashed to new yearly lows and has &hellip; <a href=\"https:\/\/cms-articles.softonic.io\/en\/following-the-stolen-ftx-money\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Blockchain investigations: Following the stolen FTX money&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9073,"featured_media":206617,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","wpcf-pageviews":0},"categories":[1015],"tags":[],"usertag":[],"vertical":[],"content-category":[],"class_list":["post-206614","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/206614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/users\/9073"}],"replies":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/comments?post=206614"}],"version-history":[{"count":1,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/206614\/revisions"}],"predecessor-version":[{"id":322909,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/posts\/206614\/revisions\/322909"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media\/206617"}],"wp:attachment":[{"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/media?parent=206614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/categories?post=206614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/tags?post=206614"},{"taxonomy":"usertag","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/usertag?post=206614"},{"taxonomy":"vertical","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/vertical?post=206614"},{"taxonomy":"content-category","embeddable":true,"href":"https:\/\/cms-articles.softonic.io\/en\/wp-json\/wp\/v2\/content-category?post=206614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}