FTX Attacker Changes Tactics to Move Stolen Funds

FTX attacker has been forced to change their tactics of converting their illicit Ethereum holdings into Bitcoin. This move was in response to THORChain-based THORSwap’s decision to transition into maintenance mode.

On Oct. 6, on-chain analyst Lookonchain reported that the FTX exploiter was no longer moving the stolen funds via THORChain.

FTX Attacker Shifts to Another Network

Instead, the attacker was swapping the stolen funds via the Threshold network. A screenshot from the analyst showed that the exploiter swapped more than 3,000 ETH for tBTC through the Threshold Network Chain.

According to tBTC’s official website, the protocol serves as a decentralized bridge between Bitcoin and Ethereum. It facilitates the conversion of users’ assets into an ERC-20 token fixed at a 1:1 peg to BTC.

This bridge eliminates the need for centralized intermediaries by employing a randomly selected cohort of node operators within the Threshold Network.

This approach enhances the security of users’ assets and maintains a robust defense mechanism.

Last week, BeInCrypto reported that the FTX attacker moved around $10 million in Ethereum for the first time in almost a year. Since then, the exploiter has swapped a total of 75,636 ETH, worth $124 million, into Bitcoin. However, the attacker’s wallet still contains 109,485 ETH, approximately $180 million as of press time.

Notably, the fund movement coincides with ex-FTX founder Sam Bankman-Fried’s trial in New York. This timing has sparked speculations that an FTX insider might be involved with the breach.

THORSwap Moves Into Maintenance

THORSwap, the FTX attacker previously preferred privacy tool, revealed that it was moving into “maintenance mode” because it does not want to facilitate the “movement of illicit funds.” 

In an Oct. 6 post on X, THORSwap revealed that consultations with advisors, legal counsel, and law enforcement agencies prompted the move. It said:

“The decision was made to temporarily transition the THORSwap interface into maintenance mode. This action was taken to swiftly curtail any further potential illicit activity. THORSwap will remain in this mode until a more permanent and robust solution can be implemented to ensure the platform’s continued security and integrity.”

The DEX further stated that this move would restrict all coin-swapping features on the platform. However, its users can still borrow and stake assets via the protocol.

Meanwhile, THORChain said THORSwap’s decision does not affect its operations, as its network remains fully operational and capable of supporting a variety of interfaces.