FTX to Compensate Victims of Phishing Attack This One Time

Cryptocurrency exchange FTX will provide $6 million in compensation to users affected by the 3Commas-connected phishing attack, but it was doing it as a “one-time thing”, founder and CEO Sam Bankman-Fried said in a tweet on 24 October.

According to the Twitter thread, the exchange does not provide compensations to users that fell victim to phishing attacks, and that the company had a large number of methods to prevent fake FTX sites from draining user funds. However, the company was going to make an exception for the first and only time, and provide roughly $6 million in compensation to affected FTX users. Bankman-Fried tweeted:

The phishing attack in question happened on 20 October, when trading bot provider 3Commas noticed unauthorized trading activity. After some investigation, the company revealed that the attacker had used multiple fake 3Commas websites to trick users into connecting their exchange accounts to his fraudulent web interface, allowing him to steal their application programming interface (API) keys.

While FTX and 3Commas were able to suspend the attackers account — and disable all compromised API keys to avoid further losses — he was still able to steal roughly $6 million from FTX users. In his Twitter thread, Bankman-Fried also proposed that the “5-5 standard” — which lets a hacker keep either $5 million or 5% of the stolen amount as bounty, whichever is the lowest — be used, and that if the attacker returns $5.7 million (roughly 95%) “we’ll absolve them”.