{"id":40925,"date":"2022-11-21T23:56:53","date_gmt":"2022-11-22T03:56:53","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=40925"},"modified":"2022-11-21T23:56:55","modified_gmt":"2022-11-22T03:56:55","slug":"ftx-hacker-distributes-over-200m-in-eth-among-12-wallets","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/ftx-hacker-distributes-over-200m-in-eth-among-12-wallets\/","title":{"rendered":"FTX hacker distributes over $200M in ETH among 12 wallets"},"content":{"rendered":"\n
The hacker who stole more than $447 million worth of cryptocurrency from FTX<\/a> has once more been seen moving the stolen money.<\/h5>\n\n\n\n
\"FTX
FTX hacker distributes over $200M in ETH among 12 wallets<\/figcaption><\/figure>\n\n\n\n

According to Etherscan data, on November 21 between 4:11 and 4:17 p.m. UTC, the attacker transferred 180,000 ETH across 12 freshly formed wallets, giving each one 15,000 ETH. At current pricing, the total amount traded was $199.3 million.<\/p>\n\n\n\n

\"\"
Recent transactions from wallet labeled “FTX Accounts Drainer” \u2014 Source: Etherscan<\/em>
<\/figcaption><\/figure>\n\n\n\n

At the time of writing, none of the 12 wallets had moved any ETH in them.<\/p>\n\n\n\n

According to others in the crypto world, the attacker may be preparing to “peel chain”<\/a> it, or divide it up into smaller and smaller portions, to mislead investigators. They may also be preparing to employ a mixing service at some time to hide which coins are theirs.<\/p>\n\n\n\n

While this was going on, some Ethereum users seem to have sent the hacker encrypted messages requesting a piece of the spoils.<\/p>\n\n\n\n

One user registered the domain name “ftx-rekt200k-pls-help.eth” through the Ethereum Name Service (ENS) to communicate that they had lost money as a result of the FTX crash and to request compensation from the hacker.<\/p>\n\n\n\n

In an effort to draw attention, they sent 21 transactions totaling 0.000001 Ether \r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a>to the hacker's address.<\/p>\n\n\n\n

Even more inventive was another user. They made 12 transactions totaling no more than 0.0001 ETH to the wallet address of the hacker after registering the ENS domain “pleasecheckutf8data.eth”.<\/p>\n\n\n\n

Inside each transaction was a UTF8 encoded message that said \u201cPlease send me 100k~, I have medical bills to pay and visit the USA this coming December. I can't walk properly, and have aggressive muscle issues. Please help! I lost most of my money on FTX.\u201d<\/p>\n\n\n\n

Additionally, the message included a link to a post on Imgur that the user claimed served as verification of their scheduled medical visit.<\/p>\n\n\n\n

On November 11, the same day that FTX filed for chapter 11 bankruptcy protection, the hack took place.<\/p>\n\n\n\n

On November 20, the hacker moved 50,000 ETH<\/a> to a different wallet before utilizing two different renBTC bridges to convert it to bitcoin.<\/p>\n\n\n\n

The hacker currently holds the 40th-largest amount of ETH.<\/p>\n","protected":false},"excerpt":{"rendered":"

The hacker who stole more than $447 million worth of cryptocurrency from FTX has once more been seen moving the stolen money. According to Etherscan data, on November 21 between 4:11 and 4:17 p.m. UTC, the attacker transferred 180,000 ETH across 12 freshly formed wallets, giving each one 15,000 ETH. At current pricing, the total […]<\/p>\n","protected":false},"author":38,"featured_media":40930,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[153,778,2118],"class_list":["post-40925","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-eth","tag-ftx","tag-hacker"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2022\/11\/hacker-hacking.webp","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/40925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/38"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=40925"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/40925\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/40930"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=40925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=40925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=40925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}