The FTX Hack: $477M Vanishes as the Empire Falls

$400-477M stolen from FTX the night it filed for bankruptcy, via a SIM swap on one employee's phone

FTX exchange

FTX was already dead when someone decided to rob the corpse. On November 11, 2022, the same night FTX filed for bankruptcy, roughly $400-477 million in crypto was drained from the exchange's wallets, the two figures reflecting the difference between prosecutors' valuation and later on-chain analysis of the assets taken.

Users watching on-chain saw the funds moving in real time and posted frantic warnings on social media. FTX's general counsel told employees the company had been "hacked" and to delete their apps immediately. The new CEO, restructuring expert John Ray III, confirmed unauthorized access to the wallets. It was chaos layered directly on top of chaos, with the exchange's collapse and its robbery happening within the same 24 hours.

For more than a year, nobody knew how it actually happened. The answer, when it finally emerged in a January 2024 indictment, turned out to be almost embarrassingly low-tech for a heist this size: a SIM swap. Prosecutors say Robert Powell, a 26-year-old Chicago-area man operating under the aliases "R," "R$," and "ElSwapo1," ran a group later dubbed the Powell SIM Swapping Crew that had been hijacking phone numbers to steal from individual victims since March 2021. On November 11, 2022, as news of FTX's bankruptcy broke, Powell allegedly directed his co-conspirators to target a specific FTX employee's cellular account. Colorado resident Emily Hernandez, using a fake ID that carried her own photo paired with the FTX employee's name and personal information, walked into an AT&T retail store in El Paso, Texas, and convinced staff to port the employee's phone number onto a device the group controlled. From there, the group intercepted the SMS authentication codes protecting FTX's crypto wallets and drained them directly.

Indiana resident Carter Rohn, who went by "Carti" and "Punslayer," was named as the third member of the conspiracy. Prosecutors said the group's broader SIM-swapping operation, which ran from March 2021 to April 2023, targeted more than 50 victims across over 15 states before the FTX theft, using stolen personal data and fraudulent IDs to hijack phone numbers and drain bank and crypto accounts. Hernandez was reportedly paid just $2,500 for her role in the FTX theft itself, a strikingly small cut of a nine-figure heist.

All three were charged with conspiracy to commit wire fraud and conspiracy to commit aggravated identity theft and access device fraud. Hernandez pleaded guilty in mid-2024 and began cooperating with investigators, facing a statutory maximum of 20 years on the wire fraud count alone, though sentencing guidelines suggested a range closer to three to four years given her cooperation. Powell and Rohn had pleaded not guilty as of their last public court appearances and remained on bond in their home districts while the case proceeded.

Sam Bankman-Fried, convicted separately in November 2023 on fraud and conspiracy charges tied to FTX's broader collapse, was never implicated in this specific theft. The timing was almost certainly coincidental rather than connected: a well-organized SIM-swapping crew watching for high-value targets happened to notice one of the biggest bankruptcy filings in corporate history land in real time, and moved on it the same day.

The case is a reminder that not every headline-grabbing crypto hack is a smart contract exploit or a state-sponsored infiltration. Sometimes the entire attack surface is a single employee's phone number and a convincing enough fake ID at a retail store, which makes it one of the cheapest nine-figure heists in the industry's history to actually execute.