On-chain sleuth ZachXBT has shared his findings on what he sees as the three most common misconceptions about the FTX hack — taking to Twitter to correct a “ton of misinformation” about the event and the possible culprits.
In a lengthy Nov. 20 post on Twitter, the self-proclaimed “on-chain sleuth” debunked speculation that Bahamian officials were behind the FTX hack, that exchanges knew the hacker’s true identity, and that the culprit is trading memecoins.
1/ I have seen a ton of misinformation being spread on Twitter and in the news about the FTX event so let me debunk the three most common things I’ve seen
“Bahamian officials are behind the FTX hack”
“Exchanges know who the hacker is”
“FTX hacker is trading meme coins” pic.twitter.com/IAtHnpJI44
— ZachXBT (@zachxbt) November 20, 2022
On the same day that FTX’s filed for bankruptcy on Nov. 11, the crypto community began flagging suspicious transactions on wallets associated with FTX, with more than $650 million transferred off the wallet.
While there was no official culprit has been identified, a Nov. 17 statement from the Securities Commission of the Bahamas (SCB) that stated it had ordered the transfer of all digital assets of FTX to a digital wallet owned by the commission around that time prompted some to believe the SCB was behind the supposed “hack.”
However, ZachXBT argued that the “0x59” wallet address associated with the hacker was a blackhat address and not affiliated with either the FTX team or the SCB because it “began selling tokens for ETH, DAI, and BNB and using a variety of bridges so crypto couldn’t be frozen on 11/12.”
“The fact 0x59 was dumping tokens and bridging sporadically was very different behavior from the other addresses who withdrew from FTX and instead sent to a multisig on chains like Eth or Tron,” he added.
Zach also notes that the blackhat wallet also had contact with another wallet, 0x24, which he suggests “has very [suspicious] behavior on-chain using sketchy services.”
“This behavior completely differs what was said about the Debtors moving assets to cold storage or Bahamian government moving assets to Fireblocks.”
ZachXBT says his final clue was the wallet address selling Ether (ETH) for renBTC and then using RenBridge, which he says will most likely end with the funds being sent to “a mixer at some point in the future.”
Blockchain analytics firm Chainalysis came to a similar conclusion in a Nov. 20 post, noting that:
“Reports that the funds…