Elliptic uncovered 'ties to Russia' in laundering stolen FTX funds

Elliptic found "links to Russia" in laundering stolen FTX funds

The UK-based analyst firm said a Russian-linked broker or intermediary was involved in the attempted legalization of assets stolen from the bankrupt exchange in 2022

Elliptic said "Russian-linked criminal groups" may have been involved in laundering funds stolen from the FTX exchange in 2022, CoinDesk wrote. Analysts said they found clues to figure out who was behind the attack.

A few days after its bankruptcy, cryptocurrency exchange FTX lost more than $400 million as a result of the hack. According to Elliptic, shortly after the incident, 65,000 Ethereum ($100 million) was transferred into bitcoins through the RenBridge platform.

Some of these funds - 2,849 bitcoins - were then processed through cryptomixers, primarily through the ChipMixer service. The funds were then mixed with assets linked to "Russian criminal networks involved in ransomware and darknet markets," Elliptic reports, making speculation about the possible involvement of a broker or middleman somehow connected to Russia.

Funds were also funneled through Sinbad.io, a crypto mixer with a documented connection to North Korea's Lazarus Group. The use of Sinbad raises suspicions about Lazarus Group, but Elliptic says the laundering strategies used in this case are less sophisticated and suggests the actions of a "Russia-linked" participant are more likely. The identity of the hacker remains unidentified, according to analysts.

Elliptic is an analytics firm founded in 2013 and based in London. The firm develops tools and software for blockchain analysis and transaction tracking, including for government organizations. The company's investors at various times have included Wells Fargo Strategic Capital (WFSC), JPMorgan, and other financial industry giants.

In June, Elliptic reported that the Atomic Wallet hackers who stole $35 million in cryptocurrencies were transferring the stolen funds through the cryptocurrency exchange Garantex. The exchange blocked the suspicious accounts but noted that international analytical services do not cooperate with Russian companies even when investigating such incidents - they directly refuse to do so or ignore initiatives.

Garantex noted that Elliptic's information is a classic blockchain markup "retroactively" (i.e. alerting the market about the risk of a transaction already after the cryptocurrency has changed many wallets), which helps in investigations but does not help in preventing illegal transactions.