The bankrupt crypto exchange issued an urgent security alert this week, warning claimants not to fall for fake recovery emails posing as official communication.
Multiple reports surfaced after the third round of creditor repayments began at the end of September, totaling roughly $1.6 billion in distributed funds. The scam messages, which closely resemble authentic updates from FTX’s restructuring administrators, are designed to trick users into visiting fraudulent websites or connecting their crypto wallets.
Cybercriminals appear to be impersonating both Kroll Restructuring Administration and the FTX Recovery Trust—the two entities responsible for managing and processing creditor claims. These fake messages often reference payout percentages, “distribution portals,” and instructions to verify accounts, all intended to lure victims into sharing sensitive information.
FTX emphasized that its official communications will never ask users to link external wallets or access third‑party websites. All legitimate updates are handled exclusively through the verified FTX claims portal.
The warning followed the platform’s third major creditor distribution, which included both domestic and international customers as well as unsecured claimants. Each participant had to pass identity verification before payments were released via approved channels. The process, according to FTX, generally takes several business days to complete.
Phishing attempts have become a growing threat across the crypto sector, particularly during major payout events or airdrops when large sums of money are in motion. Blockchain security firm ScamSniffer estimated that over $12 million worth of crypto was stolen through phishing schemes in August alone—an indicator of how sophisticated these operations have become.
The fake recovery emails targeting FTX users are especially deceptive, promising inflated repayment ratios between 118 % and 142 % of their original balances to create a sense of urgency. Some even claim to represent “trusted distribution partners” tasked with facilitating the transfers, adding legitimacy to the scam.
Analysts warn that these phishing campaigns could intensify as the FTX estate continues to release additional settlement tranches in the coming months. For many creditors who have already endured a two‑year wait, impatience and misinformation could make them more vulnerable to deception.
Since February, the FTX recovery team has distributed more than $7.8 billion of the $16.5 billion in estimated recovered assets. Creditor repayments are expected to continue through 2026, with the estate pledging to return up to 118 % of eligible account balances once the process concludes.
The exchange urged claimants to treat all unsolicited emails with suspicion, double‑check official URLs, and avoid clicking embedded links. With scammers actively exploiting public interest in the FTX refunds, cybersecurity experts say vigilance is the only real defense.
The information provided in this article is for educational purposes only and does not constitute financial, investment, or trading advice. Coindoo.com does not endorse or recommend any specific investment strategy or cryptocurrency. Always conduct your own research and consult with a licensed financial advisor before making any investment decisions.