The claim was real.
Was the seller entitled?

Inca Digital says it investigated fraud affecting two companies trading FTX debt claims, with losses of US$5.6 million. Its public case description says it traced funds to exchanges and found related dark-web activity pointing to a potential data breach. That is the investigator’s account; it is not, by itself, an adjudicated finding against a named person.

Contemporary reporting of the investigation described multiple identities, apparently manipulated video appearances and supporting credentials used to persuade buyers. The important distinction is that details of a valid claim can be used by someone who is not its rightful owner. A successful check of the record does not complete the check of the transaction.

The original account raised a possible connection with exposed bankruptcy information, including the Kroll breach. A plausible source of information is not a proven causal link. Do not state that a particular breach supplied the data unless the evidence establishes it.

Weak processes often repeat the same evidence three times. A claimant supplies a document, an email address printed on the document and a video call arranged through that address. The apparent corroboration may all originate with the same party.

Independence matters more than the number of checks. Establish which authoritative record supports the asset, which evidence links the seller to it and which route confirms payment. Record what is unresolved and who can accept that uncertainty.

The same principle applies to an instruction from someone who appears to represent a company. Authority to discuss a sale, authority to sign a transfer and authority to change the receiving account are not necessarily held by the same individual.

A convincing face on a video call does not establish that a claim belongs to the caller. A badly formatted document can be suspicious, but polished formatting is not proof of authenticity. Avoid relying on visual “tells” or the speed at which someone enters a code as a definitive fraud test.

Current NIST identity-proofing guidance treats resolution, validation, verification and fraud management as connected work. For a business transaction, the useful lesson is to combine appropriate evidence with independent checks, trained review, exceptions and a route for handling suspected fraud. It is not a universal requirement for every business to adopt a US federal identity-assurance level.

Design the process for honest customers too. Privacy, accessibility and a fair route to resolve a failed check matter. Collecting more sensitive documents without a retention policy can create another body of information for a future attacker to misuse.

The FBI’s guidance on payment-related impersonation recommends verifying changes in account details or payment procedures through an independent route. The principle is equally useful here: a changed receiving destination should trigger a supported check, not merely another reply in the same conversation.

• Agree the settlement route and the evidence needed before the transaction becomes urgent.
• Separate review of ownership from approval of payment.
• Escalate late changes, unexplained intermediaries or pressure to bypass the process.
• Keep the decision record and preserve relevant communications.
• Define when the transaction must pause because authority cannot be established.

An on-chain transfer can provide a useful trail, but it does not establish the real-world identity behind every address or guarantee recovery. If a fraud is suspected, preserve the transaction identifiers and records, activate the incident plan and obtain appropriate legal, financial and investigative help promptly.

Legal powers such as court orders and subpoenas belong within the relevant jurisdiction and process. A business or analytics provider cannot assume access to exchange-held information simply because it can trace a payment to an address.

The FTX-claims case concerns identity, ownership and payment authority. The February 2025 Bybit theft concerned a compromised signing environment and a malicious transaction presented to signers. Treating both as an undifferentiated “crypto hack” obscures the control each needed.

Management should ask for one real transaction to be walked through from initial approach to settlement. Identify which checks are independent and where a persuasive person could cause staff to rely on unverified continuity.