FTX-linked drainer wallet resumed activity with 6,250 ETH in outflows

An Ethereum address contemporaneously associated with the November 2022 drain of FTX accounts sent out 6,250 ETH in three transfers on September 30, 2023, ending months without a material outgoing transaction from that wallet.

Ethereum transaction records show transfers of 2,500 ETH at 04:56:11 UTC, another 2,500 ETH at 07:32:35 UTC and 1,250 ETH at 12:19:23 UTC. Adding those three recorded values produces the 6,250 ETH event-day total. The aggregation covers direct outflows from the identified address during the September 30 UTC calendar day; it does not measure every subsequent transfer made by recipient addresses.

The movement mattered because it reactivated funds linked by blockchain analysts and contemporary news organizations to one of the largest unresolved asset losses surrounding FTX’s collapse. It also occurred shortly before the scheduled October 3 start of FTX founder Sam Bankman-Fried’s federal criminal trial, although the transaction record did not establish any connection between the transfers and that proceeding.

What the chain showed

The first 2,500 ETH moved to a newly used intermediary address. Contemporaneous CoinDesk tracking reported that portions were then sent through the THORChain router and Railgun, while another portion remained in an intermediary wallet at the time of its report. THORChain facilitated cross-chain swaps; Railgun provided privacy-oriented transaction functionality on Ethereum.

A second 2,500 ETH transfer followed less than three hours after the first, and the original address dispatched another 1,250 ETH later on September 30. A separate contemporaneous report described conversions involving bitcoin-linked assets after the first two transfers. Those routing descriptions were observations available during the day, not proof of the recipient’s identity, legal ownership or final control of the assets.

The use of intermediary addresses and privacy or cross-chain infrastructure also limits what can be concluded from Ethereum alone. Ethereum records establish values, sending and receiving addresses, block placement and timestamps. They do not reveal who possessed the relevant private keys, why the transfers were made or what happened after value crossed into another network or entered shielded activity.

The FTX attribution remained qualified

Etherscan and contemporary reports labeled or described the source wallet as associated with the “FTX Accounts Drainer.” That label was useful for tracing, but it was not a judicial finding and did not identify an individual operator.

FTX’s restructuring team had reported in January 2023 that approximately $415 million of cryptocurrency was classified as hacked across FTX-related entities. That preliminary estimate used petition-date pricing derived from the FTX order book and was broader than the ether held by this particular address. It therefore supplies institutional context, not a wallet-level valuation or proof that every asset in the estimate followed the same path.

The distinction was especially important because FTX and FTX US accounts experienced unauthorized transfers around the November 11, 2022 bankruptcy filing, while Bahamian authorities separately directed transfers of other assets into government-controlled custody. Public labels could not substitute for transaction-by-transaction attribution among those different movements.

What September 30 did not establish

The transfers did not by themselves prove that 6,250 ETH was sold on an exchange, converted completely into bitcoin or responsible for any change in ether’s market price. No cited record identified an exchange execution, a unified sale price or a measurable event-day market impact. Current dollar figures displayed by blockchain explorers also use current prices rather than September 30, 2023 prices and are unsuitable for reconstructing the event-day value.

The defensible event-day conclusion is narrower: a wallet credibly associated with the FTX drain became active and directly transferred 6,250 ETH during September 30, with portions beginning to move through infrastructure that complicated subsequent tracing. The controller, motive and final disposition remained unknown.