{"id":513365,"date":"2022-11-21T12:19:59","date_gmt":"2022-11-21T09:19:59","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/ftx-hacker-dumps-50000-eth-still-among-top-40-ether-holders\/"},"modified":"2022-11-21T12:19:59","modified_gmt":"2022-11-21T09:19:59","slug":"ftx-hacker-dumps-50000-eth-still-among-top-40-ether-holders","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/ftx-hacker-dumps-50000-eth-still-among-top-40-ether-holders\/","title":{"rendered":"# FTX hacker dumps 50,000 ETH, still among top 40 Ether holders"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_84 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a2f20b81570d\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a2f20b81570d\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/ftx-hacker-dumps-50000-eth-still-among-top-40-ether-holders\/#%E2%80%9D_FTX_hacker_dumps_50000_ETH_still_among_top_40_Ether_holders_%E2%80%9C\" >&#8221; FTX hacker dumps 50,000 ETH, still among top 40 Ether holders  &#8220;<\/a><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9D_FTX_hacker_dumps_50000_ETH_still_among_top_40_Ether_holders_%E2%80%9C\"><\/span>&#8221; FTX hacker dumps 50,000 ETH, still among top 40 Ether holders  &#8220;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<div class=\"post-content\" data-v-887bb764>The hacker behind the bankrupt cryptocurrency exchange FTX started transferring their Ether (ETH) holding to a new wallet address on Nov. 20. The FTX wallet drainer was the 27th largest ETH holder after the hack but dropped by 10 positions after the weekend ETH dump.<\/p>\n<p>The FTX hacker drained nearly $447 million out of multiple FTX global and FTX.US exchange wallets just hours after the crypto exchange filed for Chapter 11 bankruptcy on Nov. 11. Majority of the stolen funds were in ETH, making the exploiter the 27th largest ETH whale.<\/p>\n<p>On Nov.20, the FTX wallet drainer 1 transferred 50,000 ETH to a new address, 0x866E. The new wallet address then sw<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ed the ETH for renBTC (ERC-20 version of BTC) and bridged to two wallets on the Bitcoin blockchain. One of the wallets bc1qvd\u2026gpedg held 1,070 renBTC while another wallet bc1qa\u2026n0702 held 2,444 renBTC.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/hashtag\/CertiKSkynetAlert?src=hash&amp;ref_src=twsrc%5Etfw\">#CertiKSkynetAlert<\/a> <\/p>\n<p>FTX Wallet Drainer is now the 37th largest holder of ETH<\/p>\n<p>Dropped 10 places after transferring 50,000 ETH to 0x866E this morning <\/p>\n<p>We\u2019re also continuing to see ETH swapped for renBTC in 0x866E <\/p>\n<p>Wallet currently holds ~1127 renBTC and ~19k ETH <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/sPJjtoWwud\">pic.twitter.com\/sPJjtoWwud<\/a><\/p>\n<p>\u2014 CertiK Alert (@CertiKAlert) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/CertiKAlert\/status\/1594289021030731778?ref_src=twsrc%5Etfw\">November 20, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>Crypto analytic group CertiK later tracked the bridged renBTC on bc1qvd\u2026gpedg address and found that the address employed a money laundering technique called peel chain to launder the renBTC.<\/p>\n<figure><img decoding=\"async\" src=\"https:\/\/s3.cointelegraph.com\/uploads\/2022-11\/e72aaa5c-b66d-4939-bf18-deb006969c22.jpg\"><\/figure>\n<p>A Peel chain is a technique to launder a large amount of cryptocurrency through a lengthy <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/watch-movies-tv-seriess\/\" data-internallinksmanager029f6b8e52c=\"8\" title=\"Watch Movies &amp; TV Series\" target=\"_blank\" rel=\"noopener\">series<\/a> of minor transactions. A small portion is \u2018peeled\u2019 from the subject\u2019s address in a low-value transfer. These incremental laundered funds are often transferred to exchanges where they can be converted to fiat currency or other crypto assets. <\/p>\n<p><strong><em>Related: <\/em><\/strong><strong><em>FTX hacker is now the 35th largest holder of ETH<\/em><\/strong><\/p>\n<p>At the time of the FTX hack, there were two parties involved, one black hat that managed to drain $447 million and a white hat that managed to move $186 million of FTX assets to cold storage. However, when Bahaman Securities and Exchange Commission released a notice suggesting they are trying to move assets from the FTX, it raised many eyebrows, with many claiming that the securities regulator was, in fact, the black hat behind the exploit.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Did you see this? Bahamian SEC claims to have (tried to?) &#8220;transfer all digital assets&#8221; to a digital wallet that they, not FTX, controls. If FTX is the white hat, then isn&#8217;t the Bahamian govt the black hat?<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/t.co\/ddbEmx2nyq\">https:\/\/t.co\/ddbEmx2nyq<\/a><\/p>\n<p>\u2014 zkSTONKs (@zkSTONKs) <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/zkSTONKs\/status\/1594409424323584000?ref_src=twsrc%5Etfw\">November 20, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>On-chain analyst ZachXBT <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/twitter.com\/zachxbt\/status\/1594353613664669696?s=20&amp;t=gb-LdEkYiJH_Lia7F8r_Mg\">highlighted <\/a>the token transfer pattern of the black hat wallet and said that the wallet was dumping tokens and bridging sporadically was a very different behavior from the other addresses that withdrew from FTX and instead sent to a multisig on chains like Ethereum or Tron.<\/p>\n<p>Looking at the movement of funds and the techniques involved in the transfer of these funds, It\u2019s unlikely that FTX wallet drainer 1 is under the control of the Bahamian government based on today\u2019s on-chain activity. The BTC activity is consistent with a peel chain, a form of money laundering that would be highly unusual for a government agency to be involved in.<\/p>\n<p><template data-name=\"subscription_form\" data-type=\"defi_newsletter\"><\/template><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong>\n<\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/news\/ftx-hacker-dumps-50-000-eth-still-among-top-40-ether-holders\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8221; FTX hacker dumps 50,000 ETH, still among top 40 Ether holders &#8220; The hacker behind the bankrupt cryptocurrency exchange FTX started transferring their Ether (ETH) holding to a new wallet address on Nov. 20. The FTX wallet drainer was the 27th largest ETH holder after the hack but dropped by 10 positions after the&#8230;<\/p>\n","protected":false},"author":1,"featured_media":513366,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.cointelegraph.com\/images\/1200_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS91cGxvYWRzLzIwMjItMTEvMTVmYmQ5YjQtMmJhOC00Mzg0LTk5ZDQtZjRkYmM1ZGM1MDFhLmpwZw==.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[74862,74863,74891,135234,74882,70944],"class_list":["post-513365","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-bitcoin","tag-cryptocurrencies","tag-ethereum","tag-ftx","tag-hacks","tag-hackers"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/513365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=513365"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/513365\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/513366"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=513365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=513365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=513365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}