Bankrupt Crypto Exchange FTX Probing Unauthorized Transactions

The potential hack occurred Friday after FTX filed for bankruptcy. Ryne Miller, FTX US’s general counsel, said in a Saturday tweet that FTX and FTX US had started moving all digital assets to cold storage—crypto wallets that aren’t connected to the internet—after the bankruptcy filing.

FTX is “investigating abnormalities with wallet movements related to the consolidation of FTX balances across exchanges,” Mr. Miller said on Twitter. He called the movements unauthorized transactions and said the facts are still unclear. FTX will “share more info as soon as we have it,” he said.

A post in the exchange’s official Telegram channel called the fund flows a hack.

“An active fact review and mitigation exercise was initiated immediately in response,” said

John Ray,

chief restructuring officer and chief executive of FTX. “We have been in contact with, and are coordinating with law enforcement and relevant regulators.”

Approximately $371 million in crypto assets appeared to be taken from FTX without permission, according to

Tom Robinson,

co-founder of Elliptic. More than $220 million of the tokens were quickly converted to the stablecoin dai or ether, the second-largest cryptocurrency, on so-called decentralized exchanges.

Such platforms process transactions automatically, making them popular among hackers to prevent funds from being seized, he said.

Another $186 million was also moved out of FTX’s accounts. Mr. Robinson said those assets were likely moved by FTX itself into secure storage after the bankruptcy filing.

Elliptic previously estimated that more than $500 million had been stolen in the hack. The analytics firm updated the figures after receiving new information about which transactions were authorized and which fund movements were part of the bankruptcy proceedings, according to Mr. Robinson.

Crypto exchange Kraken said it has been able to identify the user of the account associated with the unauthorized withdrawals from FTX.

“We can confirm our team is aware of the identity of the account associated with the ongoing FTX hack, and we are committed to working with law enforcement to ensure they have everything they need to sufficiently investigate this matter,” a spokeswoman for Kraken said.

“We know the identity of the user,” said Nick Percoco, chief security officer at Kraken, in an earlier tweet.

Mr. Miller of FTX US replied to Mr. Percoco’s tweet: “Interested in anything you are open to share. Could you reach out to me?”

FTX and a bevy of affiliates filed for bankruptcy Friday, revealing more than 100,000 creditors and tens of billions in assets and liabilities. The crypto exchange is facing a shortfall of up to $8 billion, The Wall Street Journal has reported.

—David Uberti and Caitlin Ostroff contributed to this article.

Write to Vicky Ge Huang at [email protected] and Elaine Yu at [email protected]

The potential hack occurred Friday after FTX filed for bankruptcy. Ryne Miller, FTX US’s general counsel, said in a Saturday tweet that FTX and FTX US had started moving all digital assets to cold storage—crypto wallets that aren’t connected to the internet—after the bankruptcy filing.

FTX is “investigating abnormalities with wallet movements related to the consolidation of FTX balances across exchanges,” Mr. Miller said on Twitter. He called the movements unauthorized transactions and said the facts are still unclear. FTX will “share more info as soon as we have it,” he said.

A post in the exchange’s official Telegram channel called the fund flows a hack.

“An active fact review and mitigation exercise was initiated immediately in response,” said

John Ray,

chief restructuring officer and chief executive of FTX. “We have been in contact with, and are coordinating with law enforcement and relevant regulators.”

Approximately $371 million in crypto assets appeared to be taken from FTX without permission, according to

Tom Robinson,

co-founder of Elliptic. More than $220 million of the tokens were quickly converted to the stablecoin dai or ether, the second-largest cryptocurrency, on so-called decentralized exchanges.

Such platforms process transactions automatically, making them popular among hackers to prevent funds from being seized, he said.

Another $186 million was also moved out of FTX’s accounts. Mr. Robinson said those assets were likely moved by FTX itself into secure storage after the bankruptcy filing.

Elliptic previously estimated that more than $500 million had been stolen in the hack. The analytics firm updated the figures after receiving new information about which transactions were authorized and which fund movements were part of the bankruptcy proceedings, according to Mr. Robinson.

Crypto exchange Kraken said it has been able to identify the user of the account associated with the unauthorized withdrawals from FTX.

“We can confirm our team is aware of the identity of the account associated with the ongoing FTX hack, and we are committed to working with law enforcement to ensure they have everything they need to sufficiently investigate this matter,” a spokeswoman for Kraken said.

“We know the identity of the user,” said Nick Percoco, chief security officer at Kraken, in an earlier tweet.

Mr. Miller of FTX US replied to Mr. Percoco’s tweet: “Interested in anything you are open to share. Could you reach out to me?”

FTX and a bevy of affiliates filed for bankruptcy Friday, revealing more than 100,000 creditors and tens of billions in assets and liabilities. The crypto exchange is facing a shortfall of up to $8 billion, The Wall Street Journal has reported.

—David Uberti and Caitlin Ostroff contributed to this article.

Write to Vicky Ge Huang at [email protected] and Elaine Yu at [email protected]