FTX Users Potentially Targeted in Possible Phishing Attack as Bankruptcy Claims Deadline Nears

FTX users have until Sept. 29 to file their bankruptcy claims.

AccessTimeIconJul 20, 2023 at 2:45 p.m. UTC
Updated Jul 20, 2023 at 7:36 p.m. UTC

Several users of bankrupt crypto exchange FTX are being targeted by a potential phishing attack after being sent a "reset password" request from the exchange's official customer support email.

The email, which has been reviewed and verified by CoinDesk, was sent by support@ftx.com - the official email address before the exchange collapsed in November.

The password reset link routes to the FTX claims portal that allows users to submit bankruptcy claims for assets they held on the platform before its demise.

Mossab Hussein, co-founder of cybersecurity firm Spidersilk, said the surprising emails can be attributed to one of two options: "It's either FTX itself sending those emails [to notify them of the claims portal] and giving people a scare. Or, someone has "a list" of emails and is bruteforce resetting their credentials via the portal."

If a hacker gained access to user's personal email addresses, they could feasibly gain access to a claimant's account and divert funds to their personal wallet.

FTX spokespersons didn't respond to request for comment immediately.

On Monday, many FTX users received an email from Kroll, the restructuring administrators of FTX, explaining that the deadline for claims is set for September 29, 2023.

FTX owes roughly $8.1 billion to customers after it imploded in a pool of leverage and illiquid tokens last November in an event that ravaged the wider crypto market.

Edited by Aoyon Ashraf.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Oliver Knight

Oliver Knight is a CoinDesk reporter based between London and Lisbon. He does not own any crypto.