According to a December 27 Bloomberg report, the U.S. Department of Justice launched investigating the whereabouts of approximately $372 million worth of missing digital assets from the now-defunct FTX and FTX US cryptocurrency exchange. On November 12, amid its bankruptcy and internal collapse, FTX alerted clients to abnormal wallet activity regarding at least 228,523 Ether (ETH) transferred from the exchange by an unknown perpetrator.

On November 11 — the day the company filed for bankruptcy — FTX US General Counsel Ryan Miller confirmed that the transactions were unauthorized and that the subsidiary exchange had moved all cryptocurrency to cold wallets as a precaution. On November 20, forensic company Elliptic reported that the unauthorized transfers amounted to $477 million, and an unknown attacker exchanged the stolen ether for RenBTC and then connected it to bitcoin (BTC) through the RenBridge service. Ren was acquired by FTX-linked hedge fund Alameda Research in 2021, and according to Elliptic, he was “laundering hundreds of millions of dollars in crypto.”

Disgraced FTX founder Sam Bankman-Freed said the incident was either perpetrated by a former FTX employee or someone who had unauthorized access to a former employee’s computer. “I narrowed the list down to eight people. I don’t know which one,” he told citizen journalist Tiffany Fong in an interview.

In the last known release update on November 29, crypto analyst ZachXBT claimed that some of the stolen funds were transferred to the Singapore-based OKX exchange using a bitcoin mixer. Lennix Lai, managing director of OKX, responded: “#OKX is aware of the situation and the team is investigating the movement of the wallet.”