On-Chain Sleuth Refutes 'Misinformation' Surrounding FTX Hacker, Says It Is Not Bahamian Regulator

Who is the FTX hacker? While many believe the Bahamian officials are behind the activity, which involved withdrawing assets from FTX, a self-proclaimed crypto detective and on-chain sleuth refuted this claim and shared his findings that disputed misconceptions about the identity of the "drainer."

The spectacular collapse of the crypto derivatives exchange FTX was enough to send the cryptocurrency industry into a tizzy. But, after Sam Bankman-Fried and several other FTX executives landed in the Bahamas, the Twitter space exploded again after on-chain sleuths uncovered that someone was hacking the centralized exchange (CEX).

Interestingly, multiple reports provided varying identities of the FTX hacker. Others claimed it was the Bahamian government who ordered the former FTX CEO to hack the exchange.

In a Twitter thread posted by the crypto detective who goes by the Twitter handle @zachxbt, he disproved claims that the Bahamian government was behind the hack, that the hacker is trading memecoins and that crypto exchanges knew the true identity of the FTX drainer.

He said the 0x59 wallet address linked to the hacker was a blackhat address, which is not connected with either FTX or the Securities Commission of the Bahamas (SCB) since it started selling tokens, so crypto assets "could not be frozen" on November 12.

"The first clue that 0x59 was a blackhat and neither Bahamian officials nor FTX team was when 0x59 began selling tokens for ETH, DAI, and BNB and using a variety of bridges so crypto couldn't be frozen on 11/12," ZachXBT revealed. "The fact 0x59 was dumping tokens and bridging sporadically was very different behavior from the other addresses who withdrew from FTX and instead sent to a multisig on chains like Eth or Tron," he added.

The on-chain sleuth also revealed that the wallet had contact with another wallet 0x24, which he said, "has very sus [suspicious] in behavior using sketchy services such as a small Russian exchange 'Laslobit.' He added, "This behavior completely differs from what was said about the Debtors moving assets to cold storage or Bahamian government moving assets to Fireblocks."

Another clue ZachXBT shared was about the wallet selling Ethereum (ETH) for renBTC and using the RenBridge, which he predicted would likely end up with the funds being sent to a mixer.

American blockchain analysis firm Chainalysis has the same conclusion as the on-chain sleuth. "Reports that the funds stolen from FTX were actually sent to the Securities Commission of The Bahamas are incorrect. Some funds were stolen, and other funds were sent to the regulators," the firm said in a tweet on Sunday.

"Funds were bridged from ETH to BTC, likely to be mixed prior to a cash out attempt," it added. "We are in touch with our partners across the ecosystem as we work to help secure as many assets as possible to return to depositors."