The investigation into the theft of $400 million from FTX continues: the police found out exactly how hackers carried out the attack

Teacher

Professional
Messages
2,677
Reputation
9
Reaction score
632
Points
113
The US District Court has already filed charges against the alleged fraudsters.

As a result of an investigation conducted by US law enforcement agencies, a link was revealed between the theft of more than $ 400 million from the FTX cryptocurrency exchange in November 2022 and a series of attacks using the SIM Swapping method.

The theft of the cryptocurrency occurred shortly after the company filed for bankruptcy, which initially raised suspicions about a possible internal crime in order to withdraw funds from crypto investors, hiding behind a cyber attack.

A January document filed in Washington County Court accuses Robert Powell, Carter Ron, and Emily Hernandez of carrying out SIM Swapping attacks that stole the personal data of 50 victims. They managed to convince telecommunications operators to transfer the victims ' phone numbers to the criminal group's devices.

It is indicated that during the attack on the "Victim Company-1" on November 11 and 12, 2022, Emily Hernandez posed as an employee of the company, and Robert Powell gained access to the exchange's account at AT&T, as a result of which more than $ 400 million in virtual currency was transferred from the company's crypto wallets.

Blockchain security company Elliptic suggested in a blog post on February 1 that "Victim Company-1" refers to FTX , as unauthorized transactions worth about $ 400 million were recorded from FTX crypto wallets after the bankruptcy announcement.

A Bloomberg report from February 1 confirms that this is indeed FTX, citing two people with knowledge of the matter.

After the hack, some of the funds were transferred to the Kraken crypto exchange. Nick Percoco, Kraken's chief security officer, said that the identity of the user behind these transfers has been established.

For several months after the attack, the attackers moved funds across various bridges and blockchains, trying to launder the stolen cryptocurrency.

SIM Swapping attacks allow attackers to intercept multi-factor authentication codes, which has already been used many times to attack well-known figures in the world of cryptocurrencies. So, the official account of the US Securities and Exchange Commission (SEC) in X was also recently attacked using SIM Swapping, as a result of which false messages were published on behalf of the commission.

John J. Smith Ray III, head of FTX and responsible for the restructuring, described the exchange's security systems as "pure hell", which probably made it a vulnerable target for a criminal group.
 
Top