The Bahamas
Crypto sleuth debunks 3 biggest misconceptions about the FTX hack
Blockchain detective ZachXBT has provided evidence refuting recent speculation about the identity of the FTX hacker and their supposed memecoin activity.
On-chain sleuth ZachXBT has shared his findings on what he sees as the three most common misconceptions about the FTX hack — taking to Twitter to correct a "ton of misinformation" about the event and the possible culprits.
In a lengthy Nov. 20 post on Twitter, the self-proclaimed “on-chain sleuth” debunked speculation that Bahamian officials were behind the FTX hack, that exchanges knew the hacker's true identity, and that the culprit is trading memecoins.
1/ I have seen a ton of misinformation being spread on Twitter and in the news about the FTX event so let me debunk the three most common things I’ve seen
— ZachXBT (@zachxbt) November 20, 2022
“Bahamian officials are behind the FTX hack”
“Exchanges know who the hacker is”
“FTX hacker is trading meme coins” pic.twitter.com/IAtHnpJI44
On the same day that FTX filed for bankruptcy on Nov. 11, the crypto community began flagging suspicious transactions on wallets associated with FTX, with more than $650 million transferred off the wallet.
While there was no official culprit has been identified, a Nov. 17 statement from the Securities Commission of the Bahamas (SCB) that stated it had ordered the transfer of all digital assets of FTX to a digital wallet owned by the commission around that time prompted some to believe the SCB was behind the supposed "hack."
However, ZachXBT argued that the “0x59” wallet address associated with the hacker was a blackhat address and not affiliated with either the FTX team or the SCB because it "began selling tokens for ETH, DAI, and BNB and using a variety of bridges so crypto couldn't be frozen on 11/12."
"The fact 0x59 was dumping tokens and bridging sporadically was very different behavior from the other addresses who withdrew from FTX and instead sent to a multisig on chains like Eth or Tron,” he added.
Zach also notes that the blackhat wallet also had contact with another wallet, 0x24, which he suggests "has very [suspicious] behavior on-chain using sketchy services."
"This behavior completely differs what was said about the Debtors moving assets to cold storage or Bahamian government moving assets to Fireblocks."
ZachXBT says his final clue was the wallet address selling Ether (ETH) for renBTC and then using RenBridge, which he says will most likely end with the funds being sent to "a mixer at some point in the future."
Blockchain analytics firm Chainalysis came to a similar conclusion in a Nov. 20 post, noting that:
"Reports that the funds stolen from FTX were actually sent to the Securities Commission of The Bahamas are incorrect. Some funds were stolen, and other funds were sent to the regulators."
FTX has also commented on the recent fund movements, posting a warning to exchanges "that certain funds transferred from FTX Global and related debtors without authorization on 11/11/22 are being transferred to them through intermediate wallets."
(2/2) Exchanges should take all measures to secure these funds to be returned to the bankruptcy estate.
— FTX (@FTX_Official) November 20, 2022
ZachXBT also highlighted the potential misinformation surrounding the claim the hacker's identity had been discovered by "Kraken or other exchanges."
The rumor had been circulating since Kraken's chief security officer claimed in a Nov.12 post that“We know the identity of the user.”
Zach says "In reality" the user identified as the hacker was likely just the FTX group securing assets to a multi-signature wallet on Tron, using Kraken due to the FTX hot wallet being out of gas for transactions., stating:
"The withdrawals to these multisigs also matched what Ryne Miller (FTX GC) had said at the time. This took place hours after the initial 0x59 withdrawals."
Related: FTX funds on the move as thief converts thousands of ETH into Bitcoin
As his last point, ZachXBT took aim at the rumor that the FTX hacker is trading memecoins, which was first noted by blockchain analytics firm CertiK.
Instead, the blockchain detective claims the transfers have been "spoofed" on the Ethereum network, citing a March blog by Etherscan community member, Harith Kamarul explaining how transactions can be faked.
Bahamian securities regulator ordered the transfer of FTX’s digital assets
The Bahamian securities regulator clarified it directed FTX to move its digital assets to a wallet owned by the commission on Nov. 12.
The Securities Commission of The Bahamas (SCB) said it had ordered the transfer of all digital assets of FTX Digital Markets (FDM) to a digital wallet owned by the commission on Nov. 12.
In a Nov. 17 statement, the SCB said it exercised its power as a regulator acting under the authority of a Supreme Court order — moving the assets to a “digital wallet controlled by the Commission, for safekeeping.”
Securities Commission of The Bahamas Assumes Control of Assets of FTX Digital Markets Ltd. pic.twitter.com/IzW4PGZSJm
— Securities Commission of The Bahamas (@SCBgov_bs) November 18, 2022
SCB justified last week’s move by stating that “urgent interim regulatory action was necessary to protect the interests of clients and creditors of FDM.”
The latest revelation could shed some light on certain movements of funds detected last week.
On Nov. 11, the crypto community flagged a number of suspicious transactions in wallets tied to FTX and FTX.US, with analysts reporting around $663 million drained. $477 million were suspected to be stolen while the remainder was believed to have been moved to secure storage by FTX themselves.
The SCB statement however did not make any mention of how much of FDM’s digital assets were moved as a result of their order.
Cointelegraph has reached out to SCB for clarity but has not received a response by the time of publication.
The commission's order would have been made only two days after the commission froze FDM’s assets on Nov. 10, suspended FTX’s registration in the country, and stripped the FTX directors of their power.
At the time, it also stated that FDM’s assets could only be moved by obtaining the approval of a provisional liquidator appointed by the Supreme Court.
Related: FTX reportedly hacked as officials flag abnormal wallet activity
The FTX bankruptcy drama has continued to unfold over the last week.
On Nov. 15, FDM filed for Chapter 15 bankruptcy protection in a New York-based court in order to seek U.S. recognition of the Bahamian liquidation proceedings.
Brian Simms, the court-appointed provisional liquidator overseeing the bankruptcy proceedings of FTX Digital Markets in the Bahamas argued in the filing that FDM wasn’t authorized to file for Chapter 11 in the United States, and rejected the validity of the filing.
On Nov. 17, an emergency motion by FTX Trading Limited argued that both the Chapter 11 case and all proceedings related to Chapter 15 filings should take place in the Delaware-based U.S. Bankruptcy Court in order to “end the chaos and to ensure that assets can be secured and marshalled in an orderly process.”
The same filing also claimed they have “credible evidence that the Bahamian government is responsible for directing unauthorized access to the Debtors’ systems for the purpose of obtaining digital assets of the Debtors—that took place after the commencement of these cases.”
Bahamian liquidators reject validity of FTX’s US bankruptcy filing
The provisional liquidator overseeing the FTX Digital Markets bankruptcy proceedings says FTX wasn’t authorized to file for bankruptcy in the U.S without his approval.
Brian Simms, the court-appointed provisional liquidator overseeing the bankruptcy proceedings of FTX Digital Markets in The Bahamas, has called into question the validity of a Chapter 11 bankruptcy filing by subsidiary FTX Trading and 134 other affiliates in a Delaware court on Nov. 14.
In the Nov. 15 document, Simms filed for Chapter 15 Bankruptcy in the United States Bankruptcy Court in the Southern District of New York, which is used when a foreign representative of the debtor seeks recognition in the U.S. for a pending foreign insolvency proceeding.
In the filing Simms notes FTX Digital is not part of the Delaware Petition, and says as the provisional liquidator he is the only one, "authorized to take any act including, but not limited to, filing the Delaware Petition," adding:
"The Provisional Liquidation Order divests FTX Digital's directors' of the ability to act, or exercise any functions, for or on behalf of FTX Digital unless expressly instructed to so by me in writing."
The Bahamas-based lawyer argues because he "did not authorize or approve, in writing or otherwise," he rejects the "validity of any purported attempt to place FTX Affiliates in bankruptcy."
He further notes, "The entire FTX Brand was ultimately operated from a single location: The Bahamas. All core management personnel likewise were located in The Bahamas."
FTX's digital asset exchange was founded in May 2019 by Sam Bankman-Fried (SBF) in Hong Kong but after China's crypto ban, SB relocated the company to the Bahamian capital of Nassau in Sept. 2021.
Simms has not asked the court to dismiss the U.S. bankruptcy proceedings, stating "no provisional relief seeking the injunction or dismissal of the Chapter 11 is presently sought" but requests the U.S courts recognize the legal actions taking place in The Bahamas.
However, he notes “it is conceivable that the FTX Affiliates that filed Chapter 11 will be impacted by the provisional relief sought,” by his filing.
Related: FTX’s ongoing saga: Everything that’s happened until now
Chapter 11 is used by businesses to help them reorganize their debts and repay creditors while continuing their operations.
The appointment of provisional liquidators followed the Bahamian securities regulator suspending FTX’s registration status and freezing its local subsidiary’s assets on Nov. 10.