A consultant used his personal wallet to save $400 million from being stolen during FTX hack: Wired

During last year’s hack of FTX, consultant Kumanan Ramanathan utilized his personal Ledger Nano hardware wallet to safeguard vulnerable assets when unusual outflows were detected by the staff, according to a Wired investigation.

On Nov. 11 2022, unusual withdrawals alarmed former staff members and executives. While FTX later reported losses surpassing $450 million, the efforts of Ramanathan and the FTX team preserved a significant portion of the assets.

Ramanathan, associated with the consulting and restructuring firm Alvarez & Marsall, volunteered to relocate a major portion of the company’s assets to his device, thereby protecting between $400 and $500 million of FTX’s cryptocurrency. The transactions, initiated by former CTO Gary Wang, helped mitigate further losses.

The assets were housed on Ramanathan’s device until FTX’s crypto custodian provider, BitGo, had cold storage wallets ready. Subsequently, the exchange collaborated with BitGo, safeguarding over $1.1 billion in total, Wired found.

Another $400 million was relayed to the Securities Commission of the Bahamas for protective purposes. This episode transpired shortly after former CEO Sam Bankman-Fried filed Chapter 11 bankruptcy protection.

Protective measures post-hack

During the hack, FTX staff voiced concerns about potential delays in initializing BitGo’s cold storage wallets, emphasizing the necessity for a prompt solution. As a result, Ramanathan volunteered to provide his Ledger wallet as a temporary security measure during an emergency meeting, as per the Wired report.

Nearly 11 months later, the identity of the hacker remains undetermined. In a later interview, Bankman-Fried alluded to the possibility that an insider, potentially a “former employee,” might have accessed FTX’s crypto wallet keys. This view was recently matched by Zane Tackett, former head of institutional sales at FTX, in an interview on The Scoop podcast.

Recently, considerable movements of assets were reported from the FTX hacker, with stolen funds moving from Ethereum to Bitcoin via cross-chain exchange services on Thorchain and Railgun. This maneuver, known as chain hopping, is employed to disguise the origin of funds.