FTX Confirms Unauthorized Access as Assets Move to Cold Storage

FTX’s new management acknowledged on November 12, 2022 that unauthorized access to certain digital assets had occurred, adding another asset-recovery crisis to the exchange group’s newly opened bankruptcy proceedings.

In a statement distributed through FTX US general counsel Ryne Miller, incoming chief executive John J. Ray III said FTX US and FTX.com were removing trading and withdrawal functionality and moving as many identifiable digital assets as possible to a new cold-wallet custodian. Ray also said the companies were coordinating with law enforcement and relevant regulators.

The announcement mattered because FTX Trading Ltd. and numerous affiliates had commenced Chapter 11 cases on November 11, 2022. Once those proceedings began, control over the debtors’ remaining property—and the ability to identify, secure and preserve it for creditors—became central. Unauthorized wallet access could reduce recoverable assets while making it harder to distinguish approved custody transfers from movements outside the debtors’ control.

What was established on November 12

Miller first said FTX US and FTX.com had initiated precautionary transfers to cold storage after the bankruptcy filings. He said the process was accelerated after unauthorized transactions were observed. A subsequent statement attributed to Ray confirmed unauthorized access but did not identify an attacker, establish a method of entry or quantify the total assets affected.

Cold storage generally separates signing credentials from internet-connected systems, reducing exposure to additional remote access. The announcement did not prove that every remaining FTX asset had been located or secured. Its narrower meaning was that the restructuring team was attempting to move assets it could identify into new custody while disabling exchange functions.

Paxos supplied a separate, issuer-level record on November 12. The company said U.S. federal law enforcement directed it to freeze Paxos-issued assets associated with four Ethereum addresses. Paxos reported freezing 11,184.38 PAX Gold tokens, or PAXG, which it valued at approximately $19 million. According to Paxos, those tokens had previously been held on FTX.com and moved to unknown addresses during the preceding 24 hours.

That valuation was Paxos’s contemporaneous approximation, not an independently calculated market close. The freeze covered only PAXG controlled through Paxos’s issuer authority; it was not a measure of all assets transferred from FTX wallets.

A regulatory dispute emerged in parallel

The Securities Commission of The Bahamas issued a separate statement dated November 12 after FTX representatives claimed withdrawals for Bahamian customers were being facilitated in compliance with local regulators.

The commission said it had not directed, authorized or suggested that FTX Digital Markets prioritize withdrawals for Bahamian clients. It warned that preferential transactions could potentially be treated as voidable preferences under the applicable insolvency regime and said it did not condone preferential treatment of any FTX investor or client.

The denial was significant because selective withdrawals could change which customers recovered assets immediately and which remained creditors in insolvency proceedings. It also showed that statements coming through FTX-controlled channels could not automatically be treated as instructions from the Bahamian regulator.

What remained unknown

As of November 12, the public record did not establish the identity or location of whoever obtained unauthorized access, the net value ultimately lost, the amount recovered, or whether every observed wallet movement shared the same cause. Reports attaching a single dollar figure to all movements mixed different tokens, valuation times and potentially authorized custody transfers.

The defensible event-date conclusion was therefore limited but consequential: FTX’s new management confirmed unauthorized access, restricted platform functions and began moving identifiable assets into new cold custody, while law enforcement, an asset issuer and the Bahamian regulator were already taking separate actions around the exchange’s rapidly fragmenting asset perimeter.