Several wallets allegedly belonging to FTX were drained of hundreds of millions of dollars in coins late on Friday night, with much of the funds transferred from Tether (USDT) into stablecoin DAI, and from staked Ethereum (stETH) into Ethereum (ETH).

It was the same day that FTX filed for Chapter 11 bankruptcy, and it looked too soon, too late at night, and too sophisticated for the actions to be attributed to liquidators.

The exodus, all visible on blockchain tracker Etherscan, totaled around $650 million according to pseudonymous blockchain sleuth ZachXBT, widely trusted by the DeFi community.

It took until after 2 am EST for FTX US general counsel Ryne Miller to call the transfers "unauthorized" and add that FTX had begun moving assets to cold wallets to "mitigate the damage."

It was a nightmare evening for anyone with funds on FTX. As the hysteria mounted, rumors flew, including one about whether FTX CEO Sam Bankman-Fried was on a plane to Argentina, and a Reuters report claiming he used a secret "back door" built into his exchange to $10 billion to his hedge fund Alameda.

Another eagle-eyed blockchain sleuth who goes by the pseudonym Foobar noticed the first transfer of $26 million and issued an alert at 9:47 pm EST.

As the movement continued in real time, Crypto Twitter erupted in theories. Was it a hack, or an inside job from FTX leadership safeguarding their own funds, directly disobeying the bankruptcy proceedings?