About 2,500 ether (ETH), worth just over $4 million tied to last year’s apparent exploitation of the FTX exchange, started moving early on Saturday, blockchain data shows.
Ether held back a wallet linked to the drainer of FTX accounts started moving for the first time in almost a year. The funds were split in half, and then a few times in subsequent trades 700 ETH transferred using the Thorchain Routerabout 1,200 ETH will be moved via the Railgun privacy tool. Another 550 ETH is in an intermediate wallet.
Railgun is a privacy wallet that allows users to store tokens and use funds for decentralized financial services such as lending and borrowing. These transactions are ring-fenced, meaning the exact use of such funds is not known.
On the other hand, Thorchain is a bridge that allows users to exchange tokens between different blockchains without revealing their wallets.
There is still 12,500 ETH (worth about $21 million at current prices) in the original wallet.
Accounts linked to FTX and FTX US were emptied on November 11, 2022, just hours after the company filed for bankruptcy and founder Sam Bankman-Fried resigned from the crypto empire he led. The attacker stole more than $600 million worth of ether at the time. In a since-deleted tweet, then-FTX general counsel Ryne Miller said the exchange was taking “precautionary measures” to safeguard funds from other FTX portfolios.
The attacker(s) who made off with the money have never been identified. About 21,500 ETH, worth $27 million at the time, was converted into the stablecoin DAI a few days after the hack. Another 288,000 ETH was left at some of the addresses affiliated with the attacker.
Saturday’s transactions come days before Bankman-Fried goes on trial in the U.S. on fraud and conspiracy to commit fraud charges filed by federal prosecutors last December. Bankman-Fried has pleaded not guilty to all charges, although other former FTX and Alameda Research executives have pleaded guilty; Some are expected to testify against their former boss.

