The hacker who stole more than $447 million worth of cryptocurrency from FTX has once more been seen moving the stolen money.
According to Etherscan data, on November 21 between 4:11 and 4:17 p.m. UTC, the attacker transferred 180,000 ETH across 12 freshly formed wallets, giving each one 15,000 ETH. At current pricing, the total amount traded was $199.3 million.
At the time of writing, none of the 12 wallets had moved any ETH in them.
According to others in the crypto world, the attacker may be preparing to “peel chain” it, or divide it up into smaller and smaller portions, to mislead investigators. They may also be preparing to employ a mixing service at some time to hide which coins are theirs.
While this was going on, some Ethereum users seem to have sent the hacker encrypted messages requesting a piece of the spoils.
One user registered the domain name “ftx-rekt200k-pls-help.eth” through the Ethereum Name Service (ENS) to communicate that they had lost money as a result of the FTX crash and to request compensation from the hacker.
In an effort to draw attention, they sent 21 transactions totaling 0.000001 Ether to the hacker’s address.
Even more inventive was another user. They made 12 transactions totaling no more than 0.0001 ETH to the wallet address of the hacker after registering the ENS domain “pleasecheckutf8data.eth”.
Inside each transaction was a UTF8 encoded message that said “Please send me 100k~, I have medical bills to pay and visit the USA this coming December. I can’t walk properly, and have aggressive muscle issues. Please help! I lost most of my money on FTX.”
Additionally, the message included a link to a post on Imgur that the user claimed served as verification of their scheduled medical visit.
On November 11, the same day that FTX filed for chapter 11 bankruptcy protection, the hack took place.
On November 20, the hacker moved 50,000 ETH to a different wallet before utilizing two different renBTC bridges to convert it to bitcoin.
The hacker currently holds the 40th-largest amount of ETH.
