The cryptocurrency world was already reeling from the collapse of FTX when an even more shocking development unfolded. Just hours after the exchange filed for Chapter 11 bankruptcy protection on November 11, 2022, an estimated $477 million in cryptoassets was drained from FTX wallets through a series of unauthorized transactions. The breach sent shockwaves through an already fragile market, with Bitcoin trading near $16,799 and Ethereum at approximately $1,255 as the full scale of the disaster became clear.
The Exploit Mechanics
The attack began at approximately 9:22 PM on November 11, 2022, when 9,500 ETH — then worth roughly $15.5 million — was moved from an FTX-controlled wallet to a newly created address. Over the next several hours, hundreds of additional cryptoasset transfers followed, eventually totaling $477 million in stolen funds. Blockchain analytics firm Elliptic confirmed that $663 million was drained in total from FTX wallets, with approximately $186 million believed to have been moved to secure storage by FTX staff and bankruptcy advisors.
The attacker demonstrated sophisticated knowledge of on-chain asset management. Recognizing that many stolen tokens, particularly stablecoins like USDT, could be frozen by their issuers, the thief immediately began swapping stolen assets for native cryptocurrencies like Ether through decentralized exchanges including Uniswap and PancakeSwap. This is a well-known anti-seizure tactic that converts traceable, freezeable tokens into native blockchain assets that no central authority can freeze.
Tether moved swiftly to freeze approximately $31.5 million in stolen USDT, and by the time the dust settled, roughly $100 million in USDT and Paxos Gold (PAXG) tokens had been frozen by their respective issuers. However, the majority of the stolen assets had already been converted to ETH before these freezes could take effect.
Affected Systems
The breach affected FTX hot wallets across multiple blockchains, including Ethereum, Binance Smart Chain, and Solana. The attacker consolidated stolen assets from these different chains using cross-chain bridges such as Multichain and Wormhole, eventually accumulating approximately 245,000 ETH in a single Ethereum wallet within three days of the initial attack.
The compromised systems included FTX primary trading infrastructure, which was already in a state of chaos following the bankruptcy filing. General Counsel Ryne Miller acknowledged abnormal wallet movements and announced that the company was moving remaining assets to a new cold wallet custodian. CEO John Ray, who had just been appointed as chief restructuring officer, stated that the company was coordinating with law enforcement and relevant regulators.
The timing of the breach — occurring during the administrative chaos of a bankruptcy filing — raised serious questions about internal security controls and access management during periods of organizational upheaval.
The Mitigation Strategy
In response to the breach, FTX leadership implemented emergency measures. Trading and withdrawal functionality were removed entirely, and all identifiable digital assets were transferred to cold wallet storage. The company engaged law enforcement agencies and blockchain analytics firms to trace the stolen funds.
However, the mitigation efforts were complicated by the complex legal situation. The Securities Commission of the Bahamas later claimed it had directed the transfer of FTX Digital Markets assets to a wallet controlled by the Commission for safekeeping. FTX lawyers filed an emergency court motion suggesting that Bahamian regulators had directed Sam Bankman-Fried to gain unauthorized access to FTX systems to transfer assets to Bahamian government custody.
Lessons Learned
The FTX hack underscores several critical security lessons for the cryptocurrency industry. First, exchange hot wallets represent a significant single point of failure, particularly during organizational crises when access controls may be in flux. Second, the speed at which stolen tokens were converted to native assets via DEXs highlights the limitations of issuer-based token freezing as a security mechanism. Third, the involvement of multiple jurisdictions — US bankruptcy proceedings, Bahamian regulators, and anonymous hackers — created a confusing chain of custody that complicated recovery efforts.
User Action Required
For users affected by the FTX collapse, the breach reinforces the fundamental importance of self-custody. Funds held on centralized exchanges are only as secure as the exchange operational security and governance. Users should maintain personal cold storage wallets, use hardware wallets for significant holdings, and never keep more funds on an exchange than necessary for active trading. The phrase “not your keys, not your coins” was never more relevant than on November 12, 2022, when nearly half a billion dollars demonstrated exactly why self-custody matters.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
converting 9500 ETH to renBTC then bridging to BTC mainnet at 9:22 PM while nobody was watching. the opsec on that attacker was something else
the fact that the first 9500 ETH moved at 9:22 PM and nobody at FTX noticed for hours tells you how broken internal controls were. chapter 11 filing and nobody watching the wallets
Nova S. the internal controls question is the real scandal. a billion dollar exchange with no multi-sig on cold wallets and no real-time monitoring. a single signer approved the drain
cold_storage_witness a billion dollar exchange with single signer cold wallets. the real scandal isnt the hack its that this was industry standard in 2022. half of CEXs still run the same setup
chain_freeze_ single signer cold wallets on a billion dollar exchange. the 186M moved by advisors vs 477M stolen split is still impossible to audit properly
477 million gone in hours and SBF was playing video games while it happened. wild how fast the house of cards fell.
SBF was literally playing league of legends while 477M drained from wallets. you cannot script this kind of negligence
the CEO was grinding ranked while $477M drained from cold wallets. you could write the entire FTX story as a dark comedy and it still wouldnt be believable
the Elliptic breakdown of the $663M vs $477M split was one of the best on-chain forensic pieces of that cycle. the remaining $186M to secure storage was FTX advisors trying to salvage something
the attacker converting ETH to renBTC then bridging to Bitcoin was a smooth op. whoever ran that knew exactly how to dodge freezes
converting to renBTC was smart because BTC chain analytics are way harder to trace than ETH. the cross-chain hop bought months of obscurity
converting to renBTC and bridging to BTC mainnet was a genius move by the attacker. once it hit bitcoin the trail got way harder to follow
chain_saw_ renBTC bridge to BTC was smart but chainalysis tracked a chunk of it through mixer analysis anyway. the cross chain hop slowed things down but did not stop the forensics
renBTC bridge to BTC was clean. whoever planned that exit understood cross-chain privacy better than the people chasing them
0xDrain.eth the renBTC bridge move was clean but chain analytics tracked most of it anyway. ren bridges arent as private as people think post-2023
the $186M moved to secure storage by FTX advisors is the part nobody focuses on. that means roughly 1 in 4 dollars drained was actually insider movement, not the attacker
Maja W. the 186M moved by advisors is the part that still needs answers. were they salvaging or hiding. the bankruptcy court never fully resolved which transactions were legitimate
Maja W. the $186M vs $477M split is what makes this case so messy. bankruptcy courts had to figure out which transactions were legitimate salvage and which were theft
Maja W. 186M moved by advisors with zero proper accounting is the most overlooked detail. one in four dollars was insider movement and nobody went to jail for it
9,500 ETH moved at 9:22 PM to a fresh address and nobody noticed for hours. that tells you everything about exchange oversight in 2022.
chapter 11 filing at 2am, wallets draining by 9pm same day. the timing was not a coincidence. someone knew exactly when the bankruptcy protection would trigger
celsius_bagholder_ chapter 11 at 2am and wallets draining by 9pm same day. the timing wasnt coincidence it was the bankruptcy automatic stay creating a window. whoever planned this understood US bankruptcy law better than FTXs own counsel
chapter 11 at 2am and wallets draining by 9pm same day. anyone who thinks the timing was coincidence has never watched a bankruptcy filing play out
chapter 11 filed at 2am and wallets start draining by 9pm. the 186M moved by advisors still has no proper accounting. salvage or hiding? nobody knows
liquidator_skeptic_ the 186M vs 477M split is what makes this case impossible. one in four dollars was moved by people who claimed to be salvaging funds. no audit trail for any of it