Tech
Share this article

Tether Blacklists Mysterious FTX Wallets as Account Drainer Liquidates MATIC, LINK, AVAX Holdings

Over $3.9m tether on Avalanche and $27.5m tether on Solana linked to the FTX account drainer has been blacklisted by Tether.

By Shaurya Malwa
Updated Nov 12, 2022, 6:52 a.m. Published Nov 12, 2022, 6:52 a.m.
Phishing attack hack hook keyboard (Shutterstock)
Phishing attack hack hook keyboard (Shutterstock)

The entity behind mysterious fund movements related to FTX crypto wallets has started liquidating token holdings from various networks.

Over $12 million in chainlink LINK$12.77 tokens were sold in early Asian hours across two transactions, shortly after reports of a hack at FTX. The entity gained just under $10 million after slippage – a term to describe losses taken by a market participant when receiving a different trade execution price than intended – implying the entity was rushing to liquidate funds.

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the The Protocol Newsletter today. See all newsletters
By signing up, you will receive emails about CoinDesk products and you agree to our terms of use and privacy policy.

Separately, activity tied to the account drainer’s wallets on the Polygon blockchain showed some 3 million MATIC tokens were sold for $2.4 million.

Stablecoin issuer Tether apparently blocked some funds tied to the account drainer’s wallets that sold tokens on Avalanche and Solana networks earlier this morning, pseudonymous blockchain sleuth ZachXBT pointed out on Twitter.

Over $3.9m tether USDT$1.0001 on Avalanche and $27.5m tether on Solana linked to the FTX account drainer has been blacklisted by Tether.

CoinDesk independently verified the code used by Tether to block such addresses and confirmed the blacklist.

Read more: Bankman-Fried’s Cabal of Roommates in the Bahamas Ran His Crypto Empire – and Dated. Other Employees Have Lots of Questions

Hack

More For You

Protocol Research: GoPlus Security

By CoinDesk Research
Nov 14, 2025
Commissioned byGoPlus
GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
View Full Report

Mais para você

New React bug that can drain all your tokens is impacting 'thousands of' websites

Por Shaurya Malwa|Editado por Sam Reynolds
16 de dez. de 2025
Hacker sitting in a room

Attackers are using the vulnerability to deploy malware and crypto-mining software, compromising server resources and potentially intercepting wallet interactions on crypto platforms.

O que saber:

  • A critical vulnerability in React Server Components, known as React2Shell, is being actively exploited, putting thousands of websites at risk, including crypto platforms.
  • The flaw, CVE-2025-55182, allows remote code execution without authentication and affects React versions 19.0 through 19.2.0.
  • Attackers are using the vulnerability to deploy malware and crypto-mining software, compromising server resources and potentially intercepting wallet interactions on crypto platforms.
Leia a história completa