FTX Hack Explained: $415 Million Crypto Theft 2026

---

1. What Happened in the FTX Hack?

In November 2022, the cryptocurrency world was rocked by one of the most significant exchange hacks in history. Shortly after FTX filed for Chapter 11 bankruptcy, hackers stole approximately $415 million in cryptocurrency from FTX wallets — $323 million from FTX International and $90 million from FTX US.

The hack occurred within 24 hours of the bankruptcy filing, adding to the chaos of FTX’s dramatic collapse. The timing was particularly suspicious: FTX had just lost billions in customer deposits, and the hack appeared to exploit the confusion surrounding the bankruptcy proceedings.

This was not an inside job by Sam Bankman-Fried or his inner circle. The hack was carried out by external actors who managed to access FTX’s wallets and drain them of hundreds of millions of dollars in digital assets.

The $415 Million Theft

The stolen funds were divided between FTX’s two main platforms. The international exchange lost approximately $323 million, while FTX US, the American arm of the exchange, lost about $90 million. The theft was confirmed by FTX’s new management team in January 2023, when they formally reported the $415 million hack to creditors.

Timeline of Events

The hack occurred during one of the most tumultuous periods in crypto history. FTX had just filed for bankruptcy after a liquidity crisis that wiped out billions in customer funds. The hack added insult to injury, as it appeared that even the remaining assets of the bankrupt exchange were being stolen.

---

2. How Was FTX Hacked?

The FTX hack was executed through a sophisticated SIM-swapping attack — a fraud technique that has become increasingly common in the cryptocurrency space.

The SIM-Swapping Attack

SIM-swapping is a fraud technique where attackers obtain personal information about a target, create fake identification documents, and convince telecom providers to transfer the victim’s phone number to a new SIM card controlled by the attackers. Once they have control of the phone number, they can bypass two-factor authentication (2FA) and gain access to cryptocurrency accounts and wallets.

In February 2024, three individuals were charged with orchestrating a SIM-swapping scam that siphoned more than $400 million from FTX. The charges revealed that the attackers had used personal information obtained through various means to impersonate FTX personnel and gain access to the exchange’s wallets.

This case highlighted a critical vulnerability in the cryptocurrency ecosystem: the reliance on SMS-based two-factor authentication, which can be easily compromised through SIM-swapping attacks.

The Bankruptcy Connection

The hack occurred immediately after FTX’s bankruptcy filing, which created confusion and chaos. The attackers exploited this confusion to move funds quickly and without detection. The bankruptcy proceedings had just begun, and FTX’s security systems were in disarray.

FTX’s new management team, led by John Ray, initially suspected that the hack might have been an inside job by Sam Bankman-Fried or his associates. However, they later confirmed that the hack was carried out by external actors using SIM-swapping techniques.

Who Was Responsible?

The investigation into the FTX hack has uncovered multiple leads. In February 2024, three individuals were formally charged with orchestrating the SIM-swapping attack that stole the funds. Blockchain analytics firm Elliptic also linked the hack to Russian hackers, suggesting that the stolen funds may have been laundered through Russian-linked crypto networks.

The investigation remains ongoing, and law enforcement agencies continue to trace the stolen funds and pursue those responsible.

---

3. Where Did the Stolen Funds Go?

The stolen FTX funds have been traced through various crypto transactions and wallets. While the hackers initially moved the funds through a series of transfers, some of the stolen assets have been recovered or seized by authorities.

Initial Fund Movements

Immediately after the hack, the stolen funds were moved through multiple cryptocurrency wallets and exchanges in an attempt to launder the money. The hackers used various techniques, including mixing services and cross-chain bridges, to obscure the trail of the stolen funds.

Blockchain analytics firms like Elliptic and Chainalysis have been tracking the movement of the stolen funds, providing valuable intelligence to law enforcement agencies.

Government Seizures and Liquidations

The US government has been actively seizing and liquidating assets linked to FTX and Alameda Research. In July 2026, the US government liquidated a wallet containing seized assets, adding to the growing list of government recoveries.

The government’s actions have been part of a broader effort to recover funds for FTX’s creditors and victims. The seized assets include not only the stolen hack proceeds but also other assets belonging to FTX and its affiliated entities.

Asset Recovery Efforts

FTX’s new management team has been working diligently to recover assets for creditors. In 2025, FTX identified approximately $5.5 billion worth of digital assets for recovery. This includes the stolen hack funds, as well as other assets that were misappropriated or lost during FTX’s collapse.

Paxos, a trust issuer, also recovered some tokens that had been stolen from FTX, demonstrating that recovery efforts are ongoing and making progress.

Legal Developments: In August 2024, FTX was ordered to pay $12.7 billion in monetary relief, and in October 2024, the Bankruptcy Court confirmed FTX’s Plan of Reorganization, paving the way for creditors to receive compensation.

---

4. FTX Hack Timeline

The table below tracks the key events surrounding the FTX hack, from the initial bankruptcy filing to the ongoing government seizures in 2026.

📌 The hack occurred within 24 hours of the bankruptcy filing, exploiting the chaos of FTX’s collapse.

---

5. Key Players in the FTX Hack Investigation

The FTX hack investigation involves multiple entities and individuals. The table below outlines the key players and their current status.

📌 The investigation involves multiple law enforcement agencies and blockchain analytics firms working to trace the stolen funds.

---

6. FTX Hack — Key Figures

The table below summarises the key financial figures associated with the FTX hack and recovery efforts.

📌 The recovery efforts are ongoing, with the US government continuing to seize and liquidate FTX-linked assets.

---

7. Security Lessons from the FTX Hack

The FTX hack offers several important lessons for both cryptocurrency exchanges and individual traders. Understanding these lessons can help prevent similar incidents in the future.

Exchange Security Best Practices

Cryptocurrency exchanges must prioritise security above all else. Key best practices include:

• Separating Custody from Trading: Exchanges should separate customer funds from trading operations, using cold storage for the majority of assets.
• Robust Multi-Factor Authentication: SMS-based 2FA is vulnerable to SIM-swapping. Exchanges should use authenticator apps or hardware security keys instead.
• Regular Security Audits: Exchanges should conduct regular security audits and penetration testing to identify vulnerabilities.
• Risk Management and Transparency: Exchanges must maintain transparent financial practices and robust risk management frameworks.

What Traders Can Learn

Individual traders can also learn valuable lessons from the FTX hack:

• Use Regulated and Transparent Exchanges: Choose exchanges that are regulated, transparent, and have a proven track record of security.
• Diversify Your Holdings: Do not keep all your cryptocurrency on a single exchange. Spread your holdings across multiple platforms and cold storage.
• Use Strong Authentication: Avoid SMS-based 2FA. Use authenticator apps or hardware security keys for all your crypto accounts.
• Stay Informed: Keep up to date with security news and best practices in the cryptocurrency space.

How to Protect Your Crypto

To protect your cryptocurrency assets, consider the following steps:

• Cold Storage: Store the majority of your cryptocurrency in cold storage (hardware wallets) that are not connected to the internet.
• Use Strong Passwords: Use unique, complex passwords for each of your crypto accounts.
• Enable Withdrawal Whitelists: Many exchanges allow you to whitelist withdrawal addresses, adding an extra layer of security.
• Monitor Your Accounts: Regularly check your account activity and set up alerts for any unusual transactions.

---

8. Frequently Asked Questions

What happened in the FTX hack?

In November 2022, shortly after FTX filed for bankruptcy, hackers stole approximately $415 million in cryptocurrency from FTX wallets — $323 million from FTX International and $90 million from FTX US.

How was FTX hacked?

The hack was carried out through a SIM-swapping attack. In February 2024, three individuals were charged with orchestrating the scheme, which involved obtaining personal information and convincing telecom providers to transfer phone numbers.

Who was responsible for the FTX hack?

Three individuals were charged with SIM-swapping that siphoned more than $400 million from FTX. Blockchain analytics firm Elliptic also linked the hack to Russian hackers.

How much money was stolen from FTX?

Approximately $415 million in cryptocurrency was stolen — $323 million from FTX’s international exchange and $90 million from its US platform.

Where did the stolen FTX funds go?

The stolen funds were initially moved through various crypto transactions. The US government has been seizing and liquidating assets linked to FTX and Alameda Research in 2025–2026.

Was anyone arrested for the FTX hack?

Yes. In February 2024, three people were charged with orchestrating a SIM-swapping scam that siphoned more than $400 million from FTX.

What is SIM-swapping and how was it used in the FTX hack?

SIM-swapping is a fraud technique where attackers obtain personal information, create fake IDs, and convince telecom providers to transfer phone numbers to new devices. This was used to bypass security measures and access FTX wallets.

Have the stolen FTX funds been recovered?

Some funds have been recovered. FTX identified about $5.5 billion in digital assets for recovery. Paxos recovered some stolen tokens, and the US government has been seizing and liquidating FTX-linked assets.

What security lessons can be learned from the FTX hack?

The hack highlighted the importance of separating crypto custody from exchange trading, using regulated and transparent exchanges, and implementing robust risk management and asset segregation.

Is the FTX hack investigation still ongoing in 2026?

Yes. The US government continues to seize and liquidate FTX and Alameda Research-linked assets. The case remains a significant part of the broader FTX bankruptcy proceedings.

---