Elliptic Links FTX’s $400 Million Loss to Russian Syndicates

Stolen assets worth an estimated $400 million from the now-defunct FTX crypto exchange have potentially been traced back to Russia-based cybercriminal groups. This revelation comes from a detailed analysis by Elliptic, a leading research firm. Five days after the theft, a significant portion, 65,000 ETH (equivalent to $100 million), was moved to the Bitcoin blockchain. For this, the attackers leveraged the services of RenBridge.

Additionally, the criminals employed a blockchain-based tool called a mixer to cover their tracks further. Elliptic’s report highlighted, “Of the 4,536 Bitcoins converted from ether at RenBridge, 2,849 BTC underwent mixing, mainly using a ChipMixer service.” However, this process isn’t foolproof. At least $4 million of these assets made their way to various exchanges, hinting at a possible cash-out attempt.

Russian Syndicates Likely Behind FTX Heist

ChipMixer faced a crackdown following international scrutiny and was shut down in a joint law-enforcement operation. Consequently, the perpetrators pivoted to another service named Sinbad for their mixing needs. Identifying the culprits remains challenging, yet certain patterns in the wallet data and the path of fund movements might offer some clues.

Moreover, while theories have emerged pointing fingers at internal rogue FTX employees or even the infamous North Korean hacker group Lazarus, recent evidence suggests a Russian connection. Elliptic’s analysis indicates, “A Russia-linked actor seems a stronger possibility.” Before landing on exchanges, a significant portion of the stolen assets merged with funds linked to Russian criminal syndicates, including those associated with ransomware attacks and darknet markets. Elliptic states it “points to the involvement of a broker or other intermediary with a nexus in Russia.”

Bankman-Fried Faces Charges Amid FTX Chaos

FTX’s saga took a dramatic turn on Nov. 11, 2022. Within hours of announcing bankruptcy and its founder, Sam Bankman-Fried’s resignation, someone emptied FTX and FTX US accounts. Not long after, federal prosecutors charged Bankman-Fried with multiple counts of fraud.

The stolen assets, which had been dormant, began showing movement a few days before Bankman-Fried’s trial. Earlier this month, thieves exchanged over 15,000 ether from the stolen assets for other tokens using the Railgun privacy wallet and THORChain exchange.

Read Also: The US CPI rose 3.7% in September, sparking volatility amid global tensions and extending losses in the crypto market.