On the move: FTX hacker splits nearly $200M in ETH across 12 wallets

The hacker down the theft of much than $447 cardinal of crypto from the crypto speech FTX has been again spotted moving their ill-gotten funds. 

According to Etherscan data, betwixt 4:11 to 4:17 p.m. UTC connected November 21, the attacker moved a full of 180,000 Ether (ETH) crossed 12 recently created wallets — each receiving 15,000 ETH. The full magnitude moved totaled $199.3 cardinal astatine existent prices.

Recent transactions from wallet labeled "FTX Accounts Drainer" — Source: Etherscan

At the clip of publication, the ETH has not moved from immoderate of the 12 wallets.

Some successful the crypto assemblage suggest the attacker whitethorn beryllium readying to subdivide it into smaller and smaller amounts successful bid to confuse investigators, a process known arsenic “peel chaining,” oregon they whitethorn beryllium readying to usage a mixing work astatine immoderate constituent to obscure which coins are theirs.

Meanwhile, immoderate Ethereum users look to person sent coded messages to the hacker asking for a stock of the loot.

One idiosyncratic registered the Ethereum Name Service (ENS) domain name, “ftx-rekt200k-pls-help.eth” to explicit that they person mislaid wealth from the FTX illness and to inquire for a reimbursement from the hacker.

They sent 21 transactions of 0.000001 Ether to the hacker’s code successful an effort to get noticed.

Another idiosyncratic was adjacent much creative. They registered the ENS domain, “pleasecheckutf8data.eth” and sent 12 transactions of 0.0001 ETH oregon little to the hacker’s wallet address.

An encoded connection asking the FTX Accounts Drainer for a stock of funds. Source: Etherscan

Inside each transaction was a UTF8 encoded connection that said “Please nonstop maine 100k~, I person aesculapian bills to wage and sojourn the USA this coming December. I can't locomotion properly, and person assertive musculus issues. Please help! I mislaid astir of my wealth connected FTX.”

The connection besides contained a nexus to an Imgur station which the idiosyncratic claimed was impervious of their aesculapian appointment.

Related: FTX hacker dumps 50,000 ETH, inactive among apical 40 Ether holders

The hack occurred connected Nov. 11, the aforesaid time that FTX filed for section 11 bankruptcy protection.

On November 20, the attacker transferred 50,000 ETH to a abstracted wallet and past converted it to Bitcoin utilizing 2 abstracted renBTC bridges.

As of today, the hacker is the 40th largest holder of ETH.