With the second wave of FTX creditor repayments approaching, cybersecurity specialists are warning of a sharp rise in phishing attempts aimed at former customers of the collapsed exchange.
The attacks are designed to look like official correspondence, claiming that account verification is complete and funds are ready to be released. Victims are then directed to imitation websites where their login credentials and personal details can be stolen.
The threat is compounded by a previous leak of creditor names and email addresses, which has allowed attackers to tailor messages to specific individuals. Security experts stress that recipients should avoid clicking links in unsolicited messages and instead manually type claims.ftx.com into their browser to access the genuine claims portal.
High Expectations Fuel Criminal Activity
The heightened scam activity coincides with anticipation around FTX’s latest repayment round, which began in late May 2025. This phase involves distributing more than $5 billion through approved partners, including BitGo and Kraken. Payout percentages differ across claim categories, with some customers recovering more than 70 percent of their eligible amounts.
Officials believe the timing of the phishing campaigns is deliberate; criminals are exploiting both the availability of leaked contact data and the urgency many creditors feel as they await long-delayed payments. Law enforcement agencies have issued alerts, reminding recipients to verify the legitimacy of any message before taking action.
Next $1.9 Billion Distribution Set for September
The FTX Recovery Trust has already scheduled the next major payout, valued at around $1.9 billion, for late September 2025. Creditors eligible for this round must have completed identity checks, tax submissions, and registration by August 15, the official record date. Payments will again be routed through BitGo, Kraken, and Payoneer.
Lawsuit Against Fenwick & West Gains Momentum
While payouts progress, a separate legal battle continues to unfold against Fenwick & West, the Silicon Valley law firm that once advised FTX. An updated lawsuit filed by a group of former customers alleges that the firm’s legal work contributed to the misappropriation of client assets, including its role in setting up corporate entities such as Alameda Research and North Dimension without adequate safeguards.
Plaintiffs claim Fenwick’s involvement extended to structuring internal arrangements that made it easier for insiders to move and conceal funds, drafting back-dated documents, and advising on encrypted communications that limited oversight. They also argue that the firm’s reputation lent FTX undue credibility with investors and regulators in the years before its collapse.
Fenwick has denied all allegations, maintaining that its work was consistent with standard legal services and that it had no role in any fraudulent activity. The case is expected to draw further attention as more evidence from bankruptcy proceedings and related criminal trials becomes public.
Caution Remains the Best Defense
For FTX creditors, the months ahead will bring both opportunities for recovery and fresh risks. Significant repayments are on the horizon, but so too are increasingly sophisticated phishing schemes aimed at derailing those recoveries. Staying within official channels, completing required verification steps, and ignoring unsolicited payment prompts are essential to avoiding losses.
With billions still to be distributed and legal accountability battles ongoing, the FTX saga remains far from over. Creditors navigating this environment must balance optimism over repayments with vigilance against the ever-present threat of cybercrime.
