The “FTX Accounts Drainer” is not the Bahamian government account. There are multiple groups and accounts with access to FTX funds.

I just want to clarify again that the "FTX Accounts Drainer", who had 250k ETH before yesterday, is a blackhat and not the Bahamian government. There are multiple groups with access to FTX funds.

I've listed examples of the accounts here so that you can compare the whitehat accounts vs the blackhat one. They behave completely differently.

Whitehat accounts

I took a look at the "whitehat" addresses mentioned by ZachXBT and Dogetoshi

Except for the first one, all the addresses below are just holding onto the tokens they received. This is completely different behavior than the "FTX Accounts Drainer" that's disrupting the Ethereum network.

Networks involved:

• Ethereum: 0xd8019a114e86ad41D71a3EeB6620b19Dd166A969 (Whitehat) – Seems to be a low-ETH purely-token account. Has been sending tokens (most shitcoins) back to their respective contracts.
• Ethereum: 0x97f991971a37D4Ca58064e6a98FC563F03A71E5c (multisig) – Only received 37.7 ETH, but received $240M worth of dozens valuable tokens like FTT, BOBA, XAUT, SRM, GMT, GMT, LEO, EURT.
• Solana: 6b4aypBhH337qSzzkbeoHWzTLt4DjG2aG8GkrrTQJfQA – Solana account with 38k SOL
• Solana: 6sEk1enayZBGFyNvvJMTP7qs5S3uC7KLrQWaEk38hSHH – Another Solana account with 144k SOL and 27.5M USDT. It then sent back the wrapped Sollet tokens to the FTX US account (JBpj7yp4Afvb71TmanVwJZXGeX4kqbGFvjCFCRo3EbTM)
• Tron: TYoZM8LALfUqm4EXzB7oKmwqusWtXTBhY6 – All the Tron assets. $22M worth of TRX, $14M worth of USDT, and many more tokens.
• Bitcoin: 325gSHHe7UGvzEc9kGx43VqPboXUVwa26i – Sitting on 3900 BTC, or $66M worth

0x59 Blackhat accounts

Ethereum: 0x59ABf3837Fa962d6853b4Cc0a19513AA031fd32b is the initial "FTX Accounts Drainer" account.

The attacker has now created dozens of separate accounts and has been sending transactions all over the place between his accounts. He's been testing multiple swaps and exchanges looking for an exit. Once he finds an exit, he keeps using it until it no longer works. The behavior is completely different than those of the other FTX groups, which seem to be holding onto their tokens until further notice.

Edit: Sorry if I'm sounding like a broken record. I just keep seeing top comments in other threads where people are assuming the attacker is the Bahamian government.

Added another Solana account. There are probably more accounts that we don't know about. It's a complete mess.