Executives scrambled to move over $1 billion worth of various assets to different storage devices as the exchange was getting drained of funds, ultimately managing to save the majority of the money. This means a majority of the exchange’s entire balance was at risk of getting stolen, as per the report.

Accounts tied to FTX and FTX.US were drained on Nov. 11, 2022, mere hours after the company filed for bankruptcy and founder Sam Bankman-Fried resigned from the crypto empire he ran.

John J. Ray III, the CEO and Chief Restructuring Officer of the FTX Debtors, which handles the FTX bankruptcy proceedings, later said that $323 million in various tokens were hacked from its international exchange and $90 million from its U.S. platform.

As per an April filing, most funds held on FTX were held on hot wallets – or crypto storage that’s directly connected to public computers that access the internet, creating an attack vector.

The attackers, whose identity remains unknown, were likely able to gain access to the private keys – or a password that gives their holders access to that wallet – of FTX’s wallets and started to drain the funds.

But, after the bankruptcy, few in the team knew the exact number of wallets owned by FTX or where their private keys were located, per Wired.

The team watched accounts getting drained in real-time before Gary Wang, an FTX co-founder who is currently facing allegations of fraud alongside Bankman-Fried, was able to access some wallets and started to transfer funds out.

Wang managed to send Kumanan Ramanathan, an adviser to FTX from legal consultancy Alvarez & Marsall, some $500 million to a wallet on Ramanathan’s Ledger Nano, a hardware wallet. The draining of FTX funds stopped after this transfer.

The next day, Wang and Bankman-Friend transferred another tranche of $500 million to wallets supplied by crypto custodian BitGo. These steps ultimately helped the firm save over $1 billion that could have otherwise been lost.

Meanwhile, the entirety of stolen funds have been on the move in the past week, deepening one of the ongoing mysteries around the exchange’s collapse last year.