FTX Exploiter

FTX Exploiter

FTX Exploiter (also seen as “FTX Accounts Drainer” or “FTX hacker”) is not a confirmed individual’s legal name, but a label used by blockchain explorers, analysts, and journalists to refer to the entity (person or group) controlling cryptocurrency wallets that received funds stolen from FTX during the exchange’s collapse in November 2022. (coindesk.com)

Origin of the label

After FTX filed for bankruptcy on November 11, 2022, hundreds of millions of dollars’ worth of crypto was moved out of FTX-controlled wallets and consolidated into attacker-controlled addresses. Media coverage commonly referred to the responsible wallet(s) as “FTX Exploiter.” (coindesk.com)

One widely cited Ethereum address associated with the incident is:

• 0x59ABf3837Fa962d6853b4Cc0a19513AA031fd32b, which Etherscan publicly labels “FTX Accounts Drainer” and describes as having drained balances from FTX accounts. (etherscan.io)

Who “FTX Exploiter” is (identity)

For much of the public reporting, the exploiter’s identity was unknown (the label referred to wallet attribution, not a verified person).

In January–February 2024, U.S. prosecutors unsealed an indictment describing a SIM-swapping and identity-theft conspiracy that allegedly included a theft of over $400 million from a company identified as “Victim Company-1,” which reporting identified as FTX. The named defendants were:

• Robert Powell
• Carter Rohn
• Emily Hernandez (cnbc.com)

According to these reports, the alleged method involved SIM swapping to take over an FTX employee’s phone number and obtain authentication codes used to access crypto wallets. (cnbc.com)

Notes on terminology

• “FTX Exploiter” is best understood as a descriptor for the attacker-controlled wallets and their controller(s), rather than a single confirmed, publicly identified person. (etherscan.io)
• The criminal case allegations name suspects, but the label itself continues to be used in blockchain tracking as a wallet tag. (etherscan.io)