FTX ‘Hacker’ Trades Prompt THORSwap to Pause Swaps

The unknown hacker, who drained $600 million from FTX after its bankruptcy, was making trades on the decentralized crypto exchange.

Decentralized crypto exchange THORSwap has entered a maintenance phase and had paused all swaps, but lending, borrowing and staking services remained fully operational, the company announced on Friday.

The pause came after the firm discovered potential movements of illicit funds, which appears to have included the so-called “FTX Exploiter” who drained funds from the notorious collapsed exchange after it filed for bankruptcy in Nov. 2022.

“Such activities have no place on the THORSwap platform, and THORSwap stands firmly against any and all criminal actions,” the company wrote on X. “Yesterday, following a careful evaluation of the situation and consultation with advisors, legal counsel, and law enforcement, the decision was made to temporarily transition the THORSwap interface into maintenance mode.”

The company said the action was necessary to prevent further illicit activity. The maintenance mode will remain in place until a “more permanent and robust solution can be implemented to ensure the platform’s continued security and integrity.”

THORSwap said there weren’t specifics to share at this time about the illicit activities. However, blockchain researcher Lookonchain on X pointed toward one likely culprit. After THORSwap paused swaps, the FTX Exploiter started to swap ether for the Theshold Network’s tBTC, a token that allows a trader to bridge bitcoin from Ethereum. The exploiter swapped 75,636 in ETH (worth about $134 million) for bitcoin assets.

The FTX Exploiter drained a number of wallets related to FTX in the hours after the Sam Bankman-Fried led exchange filed for bankruptcy and walked away with as much as $600 million. Last week, the hacker moved 15,000 ether through a number of platforms, including THORSwap. The movements straddled the start of Bankman-Fried’s criminal trial, which began in New York on Wednesday.