The FTX attacker has had to alter their strategy for converting their illicit Ethereum holdings into Bitcoin due to THORChain-based THORSwap’s shift into maintenance mode.
On October 6, on-chain analyst Lookonchain reported that the FTX exploiter was no longer using THORChain to transfer the stolen assets.
Instead, the attacker has turned to the Threshold network for swapping the stolen assets. An analyst’s screenshot revealed that the exploiter had exchanged over 3,000 ETH for tBTC via the Threshold Network Chain.
According to tBTC’s official website, this protocol acts as a decentralized bridge between Bitcoin and Ethereum, enabling users to convert their assets into an ERC-20 token pegged 1:1 to BTC. This bridge eliminates the need for centralized intermediaries by utilizing a randomly selected group of node operators within the Threshold Network, thereby enhancing asset security and maintaining a robust defense mechanism.
Last week, BeInCrypto reported that the FTX attacker had moved approximately $10 million worth of Ethereum for the first time in nearly a year. Since then, the exploiter has swapped a total of 75,636 ETH, equivalent to $124 million, into Bitcoin. However, the attacker’s wallet still holds 109,485 ETH, approximately $180 million as of the current press time.
Interestingly, the timing of these fund movements aligns with the trial of ex-FTX founder Sam Bankman-Fried in New York, raising speculations of possible involvement of an FTX insider in the breach.
THORSwap, which was previously favored by the FTX attacker for privacy, has disclosed its transition into “maintenance mode” to prevent any facilitation of illicit fund movement.
In a post on October 6, THORSwap stated that consultations with advisors, legal experts, and law enforcement agencies had led to this decision. The decentralized exchange (DEX) further indicated that this move would restrict all coin-swapping features on its platform, but users could still borrow and stake assets through the protocol.
Meanwhile, THORChain clarified that THORSwap’s decision would not impact its operations, as its network remains fully functional and capable of supporting various interfaces.