{"id":70750,"date":"2022-11-29T21:44:46","date_gmt":"2022-11-29T19:44:46","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=70750"},"modified":"2025-09-08T04:02:53","modified_gmt":"2025-09-08T01:02:53","slug":"ftx-hacker-who-breached-the-exchange-transferred-255-btc-to-okx","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/ftx-hacker-who-breached-the-exchange-transferred-255-btc-to-okx\/","title":{"rendered":"FTX hacker who breached the exchange transferred 255 BTC to OKX"},"content":{"rendered":"<p>The attacker behind the FTX breach transferred at least 255 BTC (~$4.2 million at the current rate) to the OKX exchange.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">1\/ Myself and <a href=\"https:\/\/twitter.com\/bax1337?ref_src=twsrc%5Etfw\">@bax1337<\/a> spent this past weekend looking into the FTX attacker\u2019s deposits to ChipMixer. <\/p>\n<p>It appears they\u2019ve likely been transferring a portion of the stolen FTX funds to OKX after withdrawing from CM<\/p>\n<p>So far we\u2019ve accounted for at least $4.1m (255 BTC) sent to OKX <a href=\"https:\/\/t.co\/C46JZWtktn\">pic.twitter.com\/C46JZWtktn<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1597605409883566080?ref_src=twsrc%5Etfw\">November 29, 2022<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to researchers ZachXBT and Nick bax.eth, the attacker actively used the Bitcoin mixer ChipMixer.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">2\/ Here is an example of one of the deposit addresses that received funds from ChipMixer on 11\/23. <\/p>\n<p>3QKZuAmHMmx4YikFinUbxDYgvXTCATumcE<\/p>\n<p>Each of the addresses follow a similar pattern:<\/p>\n<p>-withdrawal from CM<br \/>-50% peels off<br \/>-50% deposited to OKX <a href=\"https:\/\/t.co\/MSOEiR5fQt\">pic.twitter.com\/MSOEiR5fQt<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1597605419609997314?ref_src=twsrc%5Etfw\">November 29, 2022<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script<\/script><\/p>\n<p>They also found that the hacker began actively depositing funds into a transaction-mixing service shortly after completing operations with Ren Bridge.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">4\/ FTX attacker first began depositing BTC into ChipMixer on 11\/20 after using Ren Bridge. <\/p>\n<p>It will be interesting to see how they launder the rest of the funds in the coming weeks. <a href=\"https:\/\/t.co\/qsSJs8d8OV\">https:\/\/t.co\/qsSJs8d8OV<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1597605432780296192?ref_src=twsrc%5Etfw\">November 29, 2022<\/a><\/p><\/blockquote>\n<p> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u2018It will be interesting to monitor the laundering of the remaining funds in the coming weeks,\u2019 wrote ZachXBT.<\/p>\n<\/blockquote>\n<p>OKX CEO Lennix Lai <a href=\"https:\/\/twitter.com\/LennixOKX\/status\/1597643311350951938\">\u0437\u0430\u044f\u0432\u0438\u043b<\/a>, that his team is aware of the developments and is tracking the movement of digital assets.<\/p>\n<p>As reported in November, unknown <a href=\"https:\/\/u1f987.com\/en\/news\/unknown-actors-moved-more-than-400-million-from-ftx-wallets\">withdrew<\/a> assets from FTX wallets worth more than $400 million. A few days later the movement of funds resumed \u2014 <a href=\"https:\/\/u1f987.com\/en\/news\/address-linked-to-alleged-ftx-hack-resumes-activity\">the exchange of coins for Ethereum<\/a> began.  <\/p>\n<p>Subsequently, the hacker <a href=\"https:\/\/u1f987.com\/en\/news\/ftx-hacker-moved-50000-eth-into-ren-protocol-wrapped-bitcoin\">exchanged 50,000 ETH for wrapped Bitcoin<\/a> from Ren Protocol and connected the assets to a cross-chain bridge for transfer to the mainnet.<\/p>\n<p>Read ForkLog's Bitcoin news in our <a href=\"https:\/\/telegram.me\/forklog\" target=\"_blank\" rel=\"nofollow noopener\">Telegram<\/a> \u2014 cryptocurrency news, rates and analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The attacker behind the FTX breach transferred 255 BTC to the OKX exchange.<\/p>\n","protected":false},"author":1,"featured_media":70751,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1236,1291],"class_list":["post-70750","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-ftx","tag-okx"],"aioseo_notices":[],"amp_enabled":true,"views":"27","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/70750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=70750"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/70750\/revisions"}],"predecessor-version":[{"id":70752,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/70750\/revisions\/70752"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/70751"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=70750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=70750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=70750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}