FTX Begins $900M Payout: Kroll Breach Left Creditors Exposed to Scammers

The FTX Recovery Trust commenced its fifth major creditor distribution today, releasing approximately $900 million to hundreds of thousands of claimants worldwide through three designated payment providers — but anyone waiting on a payout should know that scammers have been running personalized phishing campaigns against FTX creditors since at least 2023, armed with real names, email addresses, and account balances stolen from the bankruptcy claims administrator’s own systems.

That last part is what makes the threat more serious than a generic crypto scam warning. In August 2023, a SIM-swap attack on a Kroll Restructuring Administration employee’s mobile phone gave attackers access to Kroll’s cloud-based systems and, through them, a database containing the names, email addresses, mailing addresses, FTX account numbers, and account balances of FTX creditors — a breach documented by security researchers at the time. Unlike a typical phishing email that any recipient can spot as generic spam, scammers using that dataset can send messages that correctly address a creditor by full name, reference their claim, and mirror the timing of legitimate distribution announcements. Creditor activist Sunil Kavuri, who has represented FTX claimants throughout the bankruptcy, said he receives fake FTX emails daily — some of which contain his full name.

FTX Will Never Ask You to Connect Your Wallet

Today’s distribution routes funds through exactly three providers: BitGo, Kraken, and Payoneer. That is the complete list of legitimate distribution service providers authorized under FTX’s Chapter 11 Plan of Reorganization. Eligible creditors who completed KYC verification, submitted required tax documentation, and onboarded with one of those three providers by the June 16, 2026 record date should expect to receive funds within one to three business days from today.

The FTX Recovery Trust included a phishing advisory directly in its July 17 official distribution announcement: the Trust will never ask creditors to connect their crypto wallets. This warning has appeared in every FTX distribution announcement since payments began in February 2025. The persistence of the warning reflects the persistence of the attacks: phishing campaigns targeting FTX creditors have intensified around each distribution date, with scammers impersonating both the FTX Recovery Trust and Kroll Restructuring Administration in fraudulent emails that reference payout percentages, “distribution portals,” and requests to verify account eligibility.

A fraudulent email that circulated during the September 2025 third distribution impersonated Kroll and told recipients: “Kroll, the restructuring administrator for FTX’s Chapter 11 bankruptcy, is preparing distributions… To access your funds, please review the email from our trusted partner, Digital Disbursements” — directing recipients to an address at noreply@digitaldisbursements.com, not any legitimate Kroll or FTX domain.

How the Kroll Breach Turned Generic Phishing Into Targeted Attacks

Phishing relies on social engineering — the manipulation of human psychology rather than technical exploitation of systems. What distinguishes the threat facing FTX creditors from ordinary crypto scam campaigns is the degree to which attackers can personalize their messages using real data from the Kroll breach.

Standard phishing emails impersonating a major exchange fail a basic test: the recipient knows they don’t actually have an account there, or the greeting says “Dear Customer” when their name is right there on their account. With Kroll-sourced data, a scammer writing to an FTX creditor can use the person’s actual name, the correct email address the creditor used when registering their claim, the actual account number associated with their FTX holdings, and a realistic claim balance figure. This is spear phishing — targeted attacks using personalized data — applied systematically across an entire creditor population.

The attacker who compromised Kroll’s systems used a SIM-swap attack: they convinced a mobile carrier to transfer a Kroll employee’s phone number to a SIM card the attacker controlled, then used that number to bypass two-factor authentication and access Kroll’s cloud systems. Kroll stated at the time that it took immediate action to contain the breach, launched an internal investigation, and informed both law enforcement and the FTX bankruptcy estate. The firm said no FTX credentials or digital assets were directly stolen in the breach.

The FTX creditor community did not agree that the damage was contained. On August 19, 2025, Hall Attorneys filed a class-action lawsuit against Kroll in the US District Court for the Western District of Texas, on behalf of FTX creditor Jacob Repko and others. The lawsuit alleges that Kroll’s negligence in protecting creditor data directly led to financial and operational harm. Repko himself told the court he lost 1.9 ETH (approximately $6,000 at then-prevailing prices) in July 2025 after a phishing attack redirected funds he was attempting to transfer to his digital wallet. The complaint also documented cases where creditors’ KYC status toggled repeatedly between “Verified” and “On Hold/Unverified” in the claims portal — a dysfunction that the lawsuit alleges Kroll’s compromised infrastructure contributed to.

Attorney Nicholas Hall stated that plaintiffs could receive monetary compensation depending on the court’s ruling, and that the case could result in operational reforms at Kroll — specifically in how the firm relies on email as its sole channel for critical creditor notices, which plaintiffs call a single point of failure.

What the Fifth Distribution Actually Pays Out

The $900 million fifth distribution covers multiple creditor classes with different incremental and cumulative recovery rates — details confirmed in the official announcement:

International (Dotcom) customer entitlement claims, Class 5A, receive an additional 9% in this round, bringing their total cumulative recovery to 105% of their allowed claim value. U.S. customer claims, Class 5B, receive an additional 5%, also reaching 105%. General unsecured creditors and digital asset loan claimants, Classes 6A and 6B, each receive an additional 3%, hitting 103% cumulative. Holders of smaller convenience-class claims — those under $50,000 — receive a cumulative payout of 120%.

Surpassing 100% recovery on creditor claims is exceptional in any bankruptcy proceeding. Under U.S. Chapter 11 law, when a debtor’s estate is solvent — meaning it has recovered more assets than it owes in allowed claims — unsecured creditors may receive post-petition interest in addition to the face value of their claims. FTX’s estate recovered between $14.5 billion and $16.3 billion in assets against approximately $11.2 billion in creditor claims — a recovery driven by rapid asset liquidation, legal settlements, and a rising crypto market in 2023 and 2024 that inflated the value of recovered holdings.

Most collapsed crypto exchanges leave creditors recovering cents on the dollar. Mt. Gox creditors waited more than a decade for partial distributions; Celsius customers recovered roughly 60-70% of their claims. FTX’s over-100% outcome is, as far as independent observers have documented, unprecedented in the sector’s history.

The fifth distribution brings the total amount returned to creditors since the estate began paying out in February 2025 to approximately $10.9 billion.

Alongside the main creditor distribution, today also sees a second payment from the Preferred Shareholder Remission Fund Trust to eligible preferred equity holders, totaling $18 million and bringing cumulative PSRFT payments to $95 million.

Third-Party Settlements Added Funds to the Recovery Pool

The estate’s ability to repay above 100 cents on the dollar also reflects a string of legal settlements with third parties. In May 2026, law firm Fenwick & West — FTX’s former primary outside legal counsel — agreed to pay $54 million to settle class-action claims alleging it helped craft legal structures that enabled the fraud. Fenwick denied the allegations, stating the firm “was not aware of the fraud at FTX, stands by the integrity of its legal work, and disputes wrongdoing of any kind.” The settlement requires final court approval.

In the same week of announcements, accounting firm Prager Metis CPAs agreed to pay $11.8 million, and former NBA player Udonis Haslem agreed to pay $420,000 to settle claims related to his promotional role for FTX — all pending court approval. A separate, active lawsuit against Fenwick filed by approximately 20 individual FTX victims from multiple countries seeks $525 million in damages and remains unresolved.

Before the fifth distribution began, the Delaware bankruptcy court approved a $600 million reduction in the estate’s disputed claims reserve, shrinking it from $2.4 billion to $1.8 billion and freeing additional liquidity for current and future distributions.

NFT Claims and Future Distribution Rounds

Holders of Allowed NFT Customer Entitlement Claims became eligible to begin the NFT distribution process starting June 30, 2026. NFT claimants must complete pre-distribution requirements, opt in, and provide a valid wallet address through the FTX Customer Portal at claims.ftx.com.

For creditors who missed the June 16, 2026 record date, subsequent distribution dates will be announced in due course by the Recovery Trust. FTX creditor representative Sunil Kavuri has indicated that additional distributions are anticipated in the October/December 2026 timeframe and through 2027 for creditors with pending or disputed claims. Disputed claims still face resolution processes that will determine final allowance amounts.

How to Verify You Are Receiving Legitimate FTX Communications

FTX’s official guidance on avoiding phishing attacks:

• Funds arrive only through BitGo, Kraken, or Payoneer — not through any other service, “Digital Disbursements,” or third-party payment processor
• The only legitimate portal for claims information is claims.ftx.com
• FTX will never ask creditors to connect their crypto wallets via email or any other channel
• All legitimate FTX Group bankruptcy documents are available at cases.ra.kroll.com/FTX
• Creditors with questions about received funds should contact their distribution service provider — BitGo, Kraken, or Payoneer — directly, not respond to unsolicited emails

Creditors are advised to access all portal links by typing the URL directly into their browser rather than clicking embedded links in any email claiming to be from FTX, Kroll, or any of the distribution providers.

The FTX official communications come only from domains listed on the cases.ra.kroll.com/FTX portal and from FTX’s verified email addresses, which are posted at support.ftx.com/hc/en-us/articles/19223337707412-Official-Email-Addresses.

---

Frequently Asked Questions

How do I know if an email about my FTX distribution is legitimate?

Legitimate FTX distribution communications will never ask you to connect your crypto wallet, click a link to claim funds through an unverified third party, or provide your private keys or seed phrase. Your funds will be paid by your pre-selected distribution provider — BitGo, Kraken, or Payoneer — directly to the account you set up during onboarding. If you receive an email directing you to a portal other than claims.ftx.com or asking you to take action through a “trusted partner” you did not select, treat it as fraudulent. Go directly to claims.ftx.com by typing the URL into your browser, not by clicking any link in email, per FTX’s official phishing advisory.

What happened to FTX creditor data in the Kroll breach — and why does it matter today?

In August 2023, attackers used a SIM-swap technique to compromise a Kroll Restructuring Administration employee’s phone number, gaining access to Kroll’s cloud systems. The breach exposed the names, email addresses, mailing addresses, FTX account numbers, and account balances of FTX creditors, as documented at the time of the incident. Scammers have since used that data to send personalized phishing emails — messages that correctly include a creditor’s full name and reference their expected payout — which are far harder to identify as fraudulent than generic spam. FTX creditors received fake personalized emails throughout subsequent distribution rounds, and creditor activist Sunil Kavuri documented receiving impersonation emails daily. A class-action lawsuit against Kroll for the breach is pending in federal court in Texas.

Why are some FTX creditors getting back more than they originally lost?

When a bankruptcy estate is solvent — meaning it recovered more assets than it owes — U.S. bankruptcy law allows creditors to receive post-petition interest on top of their allowed claim amounts. FTX recovered between $14.5 billion and $16.3 billion in assets through rapid liquidation, legal settlements, and the rising value of crypto assets between 2022 and 2024. With allowed claims of approximately $11.2 billion, the estate had enough surplus to pay creditors more than 100 cents on the dollar. Convenience-class creditors with claims under $50,000 are receiving 120% of their allowed claim value; U.S. and international customer classes have reached 105% through five distributions. This outcome is historically unusual in crypto sector bankruptcies, where most platforms that collapsed returned only fractions of what creditors were owed.

When will FTX make future distributions to creditors who did not qualify for today’s payout?

FTX’s fifth distribution on July 31, 2026 applies only to creditors who completed KYC verification, tax documentation, and provider onboarding by the June 16, 2026 record date. Creditors who missed that deadline or whose claims are still in dispute will be eligible for subsequent rounds. The FTX Recovery Trust has stated that additional record and payment dates will be announced in due course. Creditor representative Sunil Kavuri has indicated that further distributions are anticipated in the October/December 2026 period and continuing through 2027 for creditors with pending or disputed claims.