[Updated] The FTX Exploiter entity transferred out another 22,500 $ETH ($36.5M) from 2 addresses between October 5, 13:41 PM, and October 7, 19:43 PM (UTC):

• 7,500 $ETH was transferred from FTX Exploiter 0xA12 (no $ETH left in address 0xA12)
• 15,00 $ETH was transferred from a newly reactivated address, FTX Exploiter 0x5ab (no $ETH left in address 0x5ab)
• FTX Exploiter 0xA12: 0xA122d2D3D147732e2b5Cce7d43A8c20e99C569F1
• FTX Exploiter 0x5ab: 0x5ab55afcbFde83e0b3fBeff67Ed0dA73Ba7b629C

In summary, a total of 90,000 $ETH ($149.5M) has been transferred out from 6 out of the 15 addresses in the FTX Exploiter entity since September 30, of which:

• 84,959 $ETH ($140.5M) sent to Thorchain* router
• 52 $ETH ($84K) sent to Railgun contract

• 3,200 $ETH ($5.33M) swapped to 194.2 $tBTC at $27,445 on average via 3 addresses (buying $tBTC addresses below)
• 972 $ETH ($1.59M) converted to 51.3 $BTC and sent to address bc1qzc4w80p5czc03svvdsg02m557h9c9xzrsujmw4

• $tBTC buying address 1: 0x25a9184fc87a4c98c785e1645a4a7b7a5d1e6379
• $tBTC buying address 2: 0x94143e6a03e66f599cc0cfc707231de83ecf0642
• $tBTC buying address 3: 0x2992388435F97997A157789aaAbC88FD5C89886F

Currently, the FTX Exploiter entity still holds 95,746 $ETH ($157M) across 8 addresses

• check out the full list of FTX exploiters here

Fig 1. FTX exploiter still holds 95,746 $ETH ($157M) across 8 addresses.

[Previous 3] The FTX Exploiter entity further transferred out 30,000 $ETH ($49.4M) from 3 addresses to Thorchain for laundering between October 3, 8:53 AM, and October 5, 4:10 AM (UTC):

• 7,500 $ETH was transferred from FTX Exploiter 0xD53 (no $ETH left in address 0xD53)
• 15,00 $ETH was transferred from a newly reactivated address, FTX Exploiter 0x9B1 (no $ETH left in address 0x9B1)
• 7,500 $ETH was transferred from a newly reactivated address, FTX Exploiter 0xA12 (still holds 7,500 $ETH)
• FTX Exploiter 0xD53: 0xD53C2e2D17281487023C1e4433F7aC95B88D7277
• FTX Exploiter 0x9B1: 0x9B10ca213be20b8Bc2a398839Edd1F6406dc9B47

• FTX Exploiter 0xA12: 0xA122d2D3D147732e2b5Cce7d43A8c20e99C569F1

In summary, a total of 67,500 $ETH ($113M) has been transferred out from 5 out of the 15 addresses in the FTX Exploiter entity since September 30:

• 64,948 $ETH ($108M) to Thorchain* router
• 52 $ETH ($84K) to Railgun contract

• 2,500 $ETH ($4.19M) swapped to 153.4 $tBTC at $27,281 on average (buying $tBTC addresses below)

Currently, the FTX Exploiter entity still holds 118,246 $ETH ($194M) across 10 addresses

• check out the full list of FTX exploiters here

Fig 2. FTX exploiter still holds 118,246 $ETH ($194M) across 10 addresses.

[Previous 2] The FTX Exploiter entity has further transferred out 27,250 $ETH ($46.1M) to Thorchain via 3 addresses between October 1, 8:18 AM, and October 2, 8:45 PM (UTC):

• 4,750 $ETH was transferred from FTX Exploiter 0x3e9 (no $ETH left in address 0x3e9)
• 15,00 $ETH was transferred from a newly reactivated address, FTX Exploiter 0x7f3 (no $ETH left in address 0x7f3)
• 7,500 $ETH was transferred from a newly reactivated address, FTX Exploiter 0xD53
• FTX Exploiter 0x3e9: 0x3e957efc6d1bf1d9141212269cd04855ad92696e
• FTX Exploiter 0x7f3: 0x7F3DeBBA84491401bD4fE51C1A1926B049189D57

• FTX Exploiter 0xD53: 0xD53C2e2D17281487023C1e4433F7aC95B88D7277

Overall, a total of 37,500 $ETH ($63.2M) has been transferred from 3 out of 15 addresses in the FTX Exploiter entity since September 30:

• 34,999 $ETH ($59M) was sent to the Thorchain* router and Railgun contract
• 2,500 $ETH ($4.19M) was swapped to 153.4 $tBTC at $27,281 on average
• notably, the transfers took place just a few days before the trial of Sam Bankman-Fried, the former CEO of the bankrupt exchange FTX. Mr. Sam Bankman-Fried is expected to appear in court on October 3. To date, he has still pleaded not guilty to all charges

Currently, the FTX Exploiter entity still holds 148,246 $ETH ($247M) across 12 addresses.

Fig 3. FTX exploiter still holds 148,246 $ETH ($247M) across 12 addresses.

[Previous 1] FTX Exploiter 0x3e9 returns after 10 months of dormancy to transfer out a total of 10,250 $ETH ($17.1M) via 4 addresses between September 30, 4:57 AM, and October 1, 1:37 AM (UTC):

• 7,749 $ETH ($13M) was sent to the Thorchain* router and Railgun contract
• 2,500 $ETH ($4.19M) was swapped to 153.4 $tBTC at $27,281 on average via 2 addresses, 0x941 and 0x25a, and then sent to the null address 0x000, probably to bridge to Threshold Network
• this may not be the final number, as the address has been highly active after waking up (the last transaction was on October 1, 01:37 AM UTC) and may continue to transfer $ETH out
• FTX Exploiter's address: 0x3e957efc6d1bf1d9141212269cd04855ad92696e
• $tBTC buying address 1: 0x25a9184fc87a4c98c785e1645a4a7b7a5d1e6379
• $tBTC buying address 2: 0x94143e6a03e66f599cc0cfc707231de83ecf0642

Notably:

• out of the 15 addresses that are related to the $300M hack last November, FTX Exploiter 0x3e9 was the first and only address to become active again on September 30, after 10 months of dormancy
• currently, the FTX exploiter still holds a total of 175,496 $ETH ($294M) across 15 addresses, of which 4,750 $ETH ($7.96M) is kept in address 0x3e9

Fig 4. FTX exploiter currently holds 175,496 $ETH ($294M) across 15 addresses.

*THORChain is a cross-chain, decentralized liquidity protocol that enables direct swaps between different layer-1 tokens, including Bitcoin and Ethereum, without requiring users to ever leave the protocol and without the need for intermediaries.