Hackers begin laundering part of the $477 million stolen from cryptocurrency exchange FTX

The hackers who stole about $477 million in cryptocurrency from the crashing exchange FTX have begun laundering money in bitcoin.

This month, after FTX filed for bankruptcy, new CEO John Ray III said that “unauthorized access to certain assets has occurred.”

Blockchain analytics firm Elliptic estimates that around $477 million worth of cryptocurrency has been stolen from FTX.

The theft adds insult to injury to FTX, a once $32 billion crypto empire, and the crash has sent shockwaves across the industry.

The stolen money has been converted into various cryptocurrencies but the bulk of it – more than $280 million – has been changed into cryptocurrency. etheraccording to the public blockchain records of the account linked to the hackers.

Elliptic co-founder Tom Robinson told CNBC that the hackers were converting ether into a crypto product called RenBTC which is then converted into Bitcoin via a bridge. This allows one cryptocurrency to be converted into another without going through a central exchange.

“This is a common tactic in cryptocurrency laundering,” Robinson said.

Researchers at Elliptic documented how RenBridge was used to launder “hundreds of millions” of dollars in cryptocurrency suspected of originating from ransomware attacks or hacks. According to Elliptic, some of these hacks have links to Russian-backed ransomware groups.

So far, $74 million has been transferred to Bitcoin from RenBTC using RenBridge.

Alameda, a sister business to FTX, acquired RenBridge in 2021 as part of FTX’s broader effort to build out the Solana and Serum.

Serum is a “decentralized exchange,” where Serum token runs natively on Solana, promising users faster settlement and execution times. FTX and Alameda were major backers of the project, which was forked In an effort to prevent the control of FTX after bankruptcy.

On November 11, FTX users noticed unusual cryptocurrency transfers, sparking fears that the FTX platform could be compromised. Posts on FTX’s Telegram thread indicated that the app and platform had been hacked and compromised.

Further allegations that Bankman-Fried worked with regulators in the Bahamas to get cryptocurrency out of FTX wallets came after an interview with Vox — which Bankman-Fried later claimed he understood to be a casual conversation with a reporter friend — in which the former FTX CEO pinned Suspected theft of FTX coins on disgruntled employee.

FTX Deposits said it discovered the Bahamian transfers during an investigation into the cryptocurrency theft over the weekend. What those filings left unanswered was if these two were the same, or separate events.

It is not yet clear how much of the value of the assets the regulators have seized in the Bahamas. CNBC reported that FTX filed for emergency court on November 18 to stop further action by regulators in the Bahamas. FTX filings alleged that Bankman-Fried may have been working in concert with these regulators.

Hackers are some point they want to turn this money into money. However, Robinson said that it would be a “challenge” due to the “traceability of cryptocurrencies.”

He said he expects hackers to use “mixers to cover their own blockchain path.”

Mixers, Robinson said, are services or software that allow obfuscation of the path of cryptocurrency transactions on the blockchain, making it difficult or impossible to trace the funds.

“This could be one of the drivers behind moving these assets to bitcoin — the increased availability of mixing services,” he added.

The blockchain is the public ledger of cryptocurrency activity. Each coin may have its own blockchain. This makes it possible to track, to some extent, where the money is moving. Using blenders can make this difficult.

Compliance software company Crypto Chainalysis also confirmed in a tweet on Sunday that the hackers are moving the funds.

FTX on Sunday urged cryptocurrency exchanges to monitor stolen funds if hackers attempt to process funds via one of their services.

“The exchanges must take all measures to secure the return of these funds to the bankruptcy estate,” FTX said in another tweet.

FTX owes its largest creditor about $3.1 billion, according to court filings. In other words, the hacked funds represent about 15% of what FTX owes only to its largest clients.

Bankman-Fried once oversaw a sprawling crypto empire that stretched to every inhabited continent and claimed billions in assets. The collapse of FTX left Bankman-Fried paper poor, and left investors unable to access their crypto assets.