The FTX Hack: $477M Vanishes as the Empire Falls

FTX was already dead when someone decided to rob the corpse. On 11 November 2022, the same day the exchange filed for bankruptcy, crypto worth somewhere between $400 million and $477 million began draining out of its wallets. The lower figure is the one federal prosecutors later used; the higher is the blockchain analytics firm Elliptic's valuation of everything taken. FTX's own administrators put losses from "unauthorized third-party transfers" at about $413 million, after some of the coins were frozen and returned.

FTX had been one of the largest crypto exchanges in the world, the crypto equivalent of a stock exchange and a broker in one, valued at $32 billion at the start of 2022. Within ten days in November it had collapsed, after its customers learned that their deposits had been funnelled to Alameda Research, the trading firm owned by FTX's founder, Sam Bankman-Fried. On 11 November Bankman-Fried resigned and the restructuring lawyer John Ray III took over as chief executive to steer the company through Chapter 11. That night the wallets started emptying.

The night the wallets emptied

Users watching the blockchain, the public ledger that records every crypto transfer, saw the money moving in real time and posted warnings on social media. In the early hours of 12 November, Ryne Miller, FTX US's general counsel, wrote on Twitter that FTX had been hacked and told users to delete the FTX apps and avoid its website. Ray confirmed unauthorized transactions, and the company said it was moving what was left into cold storage, offline wallets that cannot be reached over the internet.

It was chaos on top of chaos. In one day the exchange had gone bankrupt, lost its founder and been robbed, and for more than a year nobody outside the investigation knew who had done it. Theories ran from rogue insiders to North Korea.

A fake ID at a phone shop

The answer, when an indictment from Washington, DC was made public at the start of February 2024, was almost embarrassingly low-tech: a SIM swap. A SIM swap is a trick in which a criminal persuades a phone company to move a victim's number onto a SIM card the criminal controls. From then on, the texts meant for the victim arrive on the criminal's phone, including the one-time security codes that many companies send by text message as a second lock on an account. It is the equivalent of persuading a bank to send someone else's replacement card and PIN to your address.

Prosecutors said Robert Powell of the Chicago area, who used the online names "R", "R$" and "ElSwapo1", ran a group they called the Powell SIM Swapping Crew, which had been hijacking phone numbers to steal from people since March 2021. On 11 November 2022, as FTX's bankruptcy broke, Powell allegedly told his partners to take over the phone account of an FTX employee, described in the indictment only as an employee of "Victim Company-1". Bloomberg later reported, citing people familiar with the case, that the victim company was FTX.

According to the indictment, Emily Hernandez, a Colorado resident, was sent a fake identity document carrying the employee's name and personal details but her own photograph. She took it into an AT&T store in Texas and had the employee's number moved to a device the group controlled. With the employee's text messages in hand, the group collected the authentication codes protecting FTX's wallets and, over the next two days, moved more than $400 million of crypto to wallets of their own. Hernandez was paid $2,500, prosecutors said.

Carter Rohn of Indiana, who used the names "Carti" and "Punslayer", was charged as the third member, accused of helping to compromise victims' devices. All three were charged with conspiracy to commit wire fraud and conspiracy to commit aggravated identity theft and access device fraud.

Sam Bankman-Fried, convicted in November 2023 of fraud and conspiracy over FTX's broader collapse and later sentenced to 25 years in prison, was never accused of any part in the theft. Nothing in the case suggests the timing was planned with anyone inside FTX. A crew that made its living watching for rich targets saw one of the biggest bankruptcies in history land in real time and moved the same day.

Where the money went

The coins did not stay put. Elliptic followed them across the blockchain for a year. The thief swapped tens of thousands of ether, the second-largest cryptocurrency, into bitcoin through cross-chain services including RenBridge and THORSwap, then pushed thousands of bitcoin through mixers, services that pool coins from many users and pay out different ones to break the trail, much like swapping marked banknotes for clean ones at a crooked bureau de change. The main one used, ChipMixer, was shut down by US and German authorities in March 2023, after which the funds moved to a newer mixer called Sinbad.

In October 2023 Elliptic reported that some of the mixed FTX bitcoin had been combined with money from Russia-linked criminal groups, including ransomware gangs and darknet markets, before being sent to exchanges. It concluded that a Russia-linked broker or intermediary was "a stronger possibility" than a rogue insider or North Korea's Lazarus Group. The indictment of three Americans a few months later suggested the phone-hijacking crew carried out the theft and someone else may have helped launder it. No recovery of the laundered coins has been publicly reported.

The pleas, and a sentencing still waiting

Hernandez pleaded guilty on 16 May 2024 in federal court in Washington to one count each of wire fraud and aggravated identity theft, and agreed to cooperate. Her plea agreement set a preliminary guideline range of 41 to 51 months in prison. Powell and Rohn initially pleaded not guilty. Court records show that Powell later signed a plea agreement, filed under seal in August 2024 and unsealed in April 2025, and that his sentencing before Judge Ana Reyes was set for September 2025, then moved to December 2025. On 1 July 2026 the judge vacated a status conference and gave the two sides 60 days to report whether sentencing could go ahead. No sentence for any of the three had been publicly reported by October 2026, and Rohn's plea status was not clear from the public record.

The FTX estate, meanwhile, has repaid far more than the thieves took. Under the bankruptcy plan, payments to former customers began in February 2025, and after a fourth round of distributions on 31 March 2026 about $10 billion had been paid out. A fifth round of about $900 million was announced for 31 July 2026. None of that money came back from the hackers.