1. The Scam Epidemic: How Creditors Lost Their Claims
The massive FTX bankruptcy case has become the largest legal process in crypto history and a prime target for cybercriminals. Following the leak of non-sensitive claimant data from the official Kroll court registry, creditors' inboxes were flooded with thousands of emails from bad actors.
The result was catastrophic: faced with aggressive scams, many users stopped trusting any mailing lists. In an attempt to protect their data, people sent genuine messages to the spam folder, mistakenly believing they were FTX scam emails. Consequently, thousands of creditors simply ignored official requests and failed to pass the KYC verification procedure within the court-mandated timeframe.
2. Anatomy of Fraud: Real Examples of Fake Emails
Malicious actors use sophisticated social engineering methods, meticulously copying the design of official portals. Below are real screenshots demonstrating typical FTX phishing emails received by institutional clients (personal data is hidden for security purposes).
Example 1: A perfectly formatted fake from FTX Digital Markets. The email manipulates distribution dates and demands that the user click a link within 24 hours under the threat of losing assets. Note the suspicious sender address (@mg.fundingtrip.com).
Example 2: Scammers imitating the Kroll Portal (FTX Noticing). The "Claim Portal" button leads to a phishing website designed to steal private keys.
Example 3: An official support response confirming that the email received by the client is fraudulent. The exchange emphasizes: official support will never ask you to connect your crypto wallets.
Example 4: An official Kroll notification regarding a cybersecurity incident, warning creditors about the risks of receiving phishing emails.
3. Registry of Authentic FTX and Kroll Email Domains
The ability to distinguish genuine emails from fakes and timely identify Kroll scam emails or FTX spoofs is critical to protecting your assets. To avoid fatal mistakes, always verify incoming messages against the following official domain registry.
| Category / Domain | Official Role and Example Addresses |
|---|---|
| ftx.com ✅ OFFICIAL DOMAIN | Debtor communications, KYC verification, taxes, general notices. Examples: support@ftx.com, KYC-Support@ftx.com |
| ra.kroll.com / kroll.com ✅ CLAIMS AGENT | Notifications regarding official court documents. Q&A inbox. Examples: ftxinfo@ra.kroll.com, ftxquestions@kroll.com |
| bitgo.com / kraken.com ✅ DISTRIBUTION PARTNERS | Support for distributions and onboarding on partner exchanges. Examples: ftxcreditors@bitgo.com |
Important Note: Be extremely cautious with domain spoofing. For instance, domains like ftx-claims.com or kroll-claims.com are fraudulent.
4. Main Phishing Indicators (Red Flags)
When receiving correspondence, pay close attention to the following critical signs of deception that expose FTX scam emails:
- Demand for Immediate Action: Manipulative ultimatums such as "Verify your wallet within 24 hours."
- Requests for Private Data: No legitimate agent will ask for your Seed phrase or request you to link a Web3 wallet (e.g., MetaMask) to the distribution portal.
- Payment Requests: Requests to transfer a small fee (in crypto assets) to supposedly "unlock" payouts.
- Shortened Links: The use of unofficial domains or URL shortening services within the body of the email.
5. Defense Protocol: 3 Steps to Security
Information Quarantine
Stop clicking on links in suspicious emails. All navigation should be done by manually entering verified domains in your browser (claims.ftx.com). Filter your inbox for official Kroll addresses.
Correspondence Archiving
Maintain a communication log. Official emails from the exchange may be required by your lawyers in the future if disputes arise over distribution amounts.
Status Audit
Regularly log into the official debtor portal to check the status of your claim. Ensure that your KYC checkmark is glowing green.
6. What to Do If You Missed FTX KYC? The Harsh Reality
Many creditors, terrified by massive phishing campaigns, completely ignored all correspondence. Consequently, they did not log into the official portal, failed to answer genuine requests, and missed the KYC deadline. The consequences of this are fatal.
Example of a Lost Claim: A client with a balance of over $240,000 failed to pass KYC on time, getting lost in the informational noise and ignoring the official portal. The result is an "Unverified" status and blocked asset distribution.
Excusable Neglect Doctrine: Legal Insight
It is crucial to understand US legal practice: the argument "My inbox was attacked by FTX scam emails, I was afraid of fraud, and therefore I did not pass verification" is not accepted by the court. The burden of due diligence lies with the creditor.
The law allows for a late claim submission under the doctrine of Excusable Neglect. However, the court will only grant the motion if you can present documentary evidence of a physical or objective inability to pass KYC.
Legitimate reasons for the court include:
• Being in a medical coma or severe hospitalization.
• Incarceration.
• Military service (e.g., deployment in a combat zone).
• Complete isolation in a region without physical access to communication for the entire duration of the claims filing period.
Successfully navigating such complex procedural frameworks requires preliminary preparation of an evidence base and an expert Legal Opinion confirming the creditor's good faith. Basic criteria for working with Reclaim Capital to restore your rights:
- The size of your frozen balance is over $100,000.
- You have retained reliable proof of account ownership (screenshots, transaction histories).
- You have ironclad documentary evidence (medical certificates, military orders, court rulings, etc.) proving that you were physically unable to pass verification during the established period.
7. Institutional Standard: Zero Trust Architecture
For corporate clients with balances in the millions of dollars, basic caution is not enough. If your assets have previously been subjected to regulatory blocks or are involved in requests such as an LEA Request, investment funds and Family Offices must immediately implement a Zero Trust protocol when handling any information, preventing accidental engagement with FTX scam emails.
- Hardware Isolation: Access to the Claim Portal must be executed exclusively from a dedicated "clean" device that is not used for everyday surfing or corporate email.
- Ban on Hot Links: Strict protocol for employees: a total ban on clicking any hyperlinks in incoming emails. Addresses must only be entered manually from a secure internal registry.
- Multisig Authorization: Any actions regarding linking new wallets for distribution must require the signature of at least two compliance officers.
Do You Have the Documentary Base for Recovery?
If you missed deadlines due to compelling physical or medical reasons, we help institutional clients and major investors with FTX claim recovery, providing legal support at all stages of the bankruptcy process.
Frequently Asked Questions (FAQ)
Where should I forward a suspicious email for verification?
Can a genuine email demand payment?
Can a claim be recovered if the deadline was missed due to phishing?
This material was prepared by the analytical department of Reclaim Capital. We specialize in managing special situations in complex jurisdictions. Our core profile is compliance audit, digital asset protection, and legal support in cryptocurrency exchange bankruptcy cases. This article is for informational purposes only and does not constitute legal or financial advice.
For institutional inquiries and confidential case evaluations: @ReclaimCapital
