FTX investigating $662 million worth of ‘unauthorized transactions’ in a 24-hour period after declaring bankruptcy  

The announcement comes as FTX customers grapple with the crypto exchange’s plunge into Chapter 11 proceedings on Friday.

Sam Bankman-Fried resigned as FTX CEO Friday after the crypto exchange's sudden collapse. Tom Williams—CQ-Roll Call, Inc via Getty Images)

Sign up for the Fortune Features email list so you don’t miss our biggest features, exclusive interviews, and investigations.

Sam Bankman-Fried’s bankrupt digital-asset exchange FTX was hit by a mysterious outflow of about $662 million in tokens in the past 24 hours, the latest twist in one of the darkest periods for the crypto industry.

Customers still coming to terms with the platform’s Friday plunge into Chapter 11 proceedings were subsequently confronted with what the general counsel of its US arm, Ryne Miller, described as “abnormalities with wallet movements.”

Subscribe to unlock this article and get full access to Fortune.com

Sam Bankman-Fried’s bankrupt digital-asset exchange FTX was hit by a mysterious outflow of about $662 million in tokens in the past 24 hours, the latest twist in one of the darkest periods for the crypto industry.

Customers still coming to terms with the platform’s Friday plunge into Chapter 11 proceedings were subsequently confronted with what the general counsel of its US arm, Ryne Miller, described as “abnormalities with wallet movements.”

Miller said on Twitter that FTX had begun moving digital assets into cold storage — wallets that are unconnected to the internet — following its bankruptcy filing on Friday. The process was later expedited “to mitigate damage upon observing unauthorized transactions.”

Blockchain analytics firm Nansen, which gave the overall estimate of $662 million in withdrawals, said the coins flowed out of both FTX’s international and US exchanges. A separate analysis by Elliptic stated that initial indications showed almost $475 million had been stolen from the exchange in illicit transactions, with the stablecoins and other tokens that were taken being rapidly converted to Ether on decentralized exchanges — “a common technique used by hackers in order to prevent their haul being seized.”

Paolo Ardoino, chief technology officer at stablecoin issuer Tether, referenced a tweet suggesting it had blacklisted more than $30 million of the “FTX attacker’s” holdings in its USDT token.

“It’s unclear exactly who’s making the transactions, but you wouldn’t expect to see these on-chain trades at this time,” said Alex Svanevik, chief executive officer at Nansen.

The latest developments are another blow for the crypto sector, which is reeling from a year-long rout as well as the implosion of Bankman-Fried’s exchange and sister trading house Alameda Research. If the outflows are a security exploit, they would add to what’s shaping up to be a record year for attacks on the digital-token industry.

The main wallet belonging to FTX was drained of its entire balance in FTT during the incident, according to Nansen. The FTT coins are native to the exchange. Nansen said the overall outflows from FTX eventually ceased.

FTX’s descent into bankruptcy capped the downfall of one of crypto’s wealthiest moguls. The US Securities and Exchange Commission is investigating how closely intertwined his businesses were and whether FTX mishandled customer funds.

Twitter was rife with protests apparently from aggrieved clients. They cited a community Telegram chat warning that FTX had been compromised and that some client accounts were drained. The claims couldn’t be immediately verified and several calls to FTX officials outside regular US business hours went unanswered.