FTX wallets were on the move late on Friday night, the same day that FTX and its related companies filed for Chapter 11 bankruptcy. And it looked too soon, too late at night, and too sophisticated for the actions to be attributed to liquidators.

Several wallets allegedly belonging to FTX were drained of hundreds of millions of dollars in coins, with funds being transferred from Tether (USDT) into stablecoin DAI and from staked Ethereum (stETH) into Ethereum (ETH).

The exodus totals around $650 million according to an estimate by blockchain sleuth ZachXBT.

Blockchain developer and auditor Foobar noticed the first transfer of $26 million and issued an alert at 9:47 pm EST.

As the movement continued in real time—all trackable on Etherscan—Crypto Twitter erupted in theories. Was it a hack, or an inside job from FTX leadership safeguarding their own funds, directly disobeying the bankruptcy proceedings? 

“Hundreds of millions of dollars are now flowing out of FTX wallets. Some speculate liquidators, but it’s late on a Friday night, not typical times for such rapid heavy movements,” Foobar tweeted. 

“Multiple former FTX employees confirmed to me they do not recognize these transfers,” ZachXBT tweeted at 10:48 pm EST.

According to blockchain tracking website DeBank, $280,726,364 in ETH, $99,276,088 in BNB, and $3,970,099 in AVAX were sent to one of the receiving wallets.

The draining continued.

At 11:08 pm EST, FTX US general counsel Ryne Miller tweeted, “Investigating abnormalities with wallet movements related to consolidation of ftx balances across exchanges.” As crypto sleuths on Twitter surmised, Miller would have been informed if the funds were being moved as part of the liquidation process. 

Just before midnight, an FTX Telegram administrator named Rey posted: “Ftx has been hacked. All funds seem to be gone.”FTX apps are malware. Delete them. Chat is open. Don’t go on ftx site as it might download Trojans.”

In cybersecurity, Trojans (named after the Trojan Horse of Greek mythology) are programs that claim to perform one function but actually do another, typically malicious. Trojans can take the form of attachments, downloads, and fake videos.

But many onlookers did not buy the idea that this was a hack.

“If you think FTX is being hacked right now, you should consider quitting crypto. you are too kind and gullible for this industry,” DeFi Pulse founder Scott Lewis tweeted.

Twitter “chief Twit” Elon Musk took the opportunity to point out that all the action was playing out on Twitter.

It took until 2:07 am EST for Ryne Miller to provide another update. He claimed that earlier on Friday FTX and FTX US had “initiated precautionary steps to move all digital assets to cold storage” and that the “process was expedited this evening to mitigate damage upon observing unauthorized transactions.”

 

On Thursday, the securities commission of the Bahamas, where FTX is headquartered, ordered FTX’s assets frozen and assigned a liquidator to the company. 

So far, $3 billion in crypto has been stolen in 2022 through 125 different hacks, according to Chainalysis.

Once the dust settles from the FTX draining, if it was indeed a hack, that figure will surpass the previous all-time high of $3.2 billion set last year.