FTX has restored full access to its claims portal, allowing customers of the collapsed crypto exchange to resume filing and managing bankruptcy claims after a recent cybersecurity incident tied to claims agent Kroll. The company said accounts that had been frozen in response to the breach in August have now been unfrozen following a review and security assessment.
The update marks an important step in the long-running FTX bankruptcy process, which has involved millions of customers and creditors seeking to recover losses after the exchange imploded in November 2022. In a public statement posted on X, FTX said that after evaluating the recent Kroll incident, it had reinstated access for all affected users and implemented additional safeguards to better secure the portal.
What Happened in the Kroll Breach
The disruption began after Kroll, the restructuring administration firm handling claims in the FTX bankruptcy, disclosed a cyberattack on August 25. According to Kroll, a threat actor targeted a T-Mobile US account associated with one of its employees in what the company described as a highly sophisticated SIM-swapping attack.
Kroll said the attacker was able to gain control of the employee’s phone number after T-Mobile transferred the number to the threat actor’s device. The company stated that this occurred without authorization from, or contact with, Kroll or the employee. Once the number was compromised, the attacker apparently accessed certain files containing personal information related to bankruptcy claimants.
The incident was not limited to FTX. Kroll said the exposed files involved claimants in the bankruptcy cases of FTX, Blockfi, and Genesis. While the company acknowledged access to some personal information, it also said it had taken steps to secure the affected accounts and found no evidence that other systems or accounts were impacted.
FTX Reopens the Portal
In the immediate aftermath of the breach, FTX froze some user accounts linked to the claims portal as a precautionary measure. That move temporarily interrupted access for certain claimants, adding another layer of complexity to an already sensitive recovery process. The latest announcement indicates those restrictions have now been lifted.
FTX said claimants can once again carry out activities on the portal, signaling that the company believes the system is secure enough to resume normal operations. Although FTX did not provide technical details on the new protective controls, it said that additional security measures have been implemented following the review of the Kroll cybersecurity incident.
For creditors and former customers, the reopening of the portal is significant because the claims process is one of the key channels through which they can pursue potential recovery. Any disruption to access can delay submissions, updates, and communications tied to the broader bankruptcy proceedings.
Security Risks Around Bankruptcy Claims
The Kroll breach highlighted a persistent operational risk in high-profile insolvency cases: the concentration of sensitive claimant data in third-party systems. Bankruptcy administrators often hold names, contact details, claim documentation, and other records that can be valuable to cybercriminals. In crypto-related failures, these records may be especially attractive because of the financial scale involved and the public visibility of the cases.
SIM-swapping attacks are particularly concerning because they can allow attackers to intercept calls, text messages, and in some cases multi-factor authentication codes. That makes them a potent tool for account takeover and data access, even when a company’s internal systems are not directly breached.
In this case, Kroll’s statement suggested the compromise stemmed from a telecom-level transfer rather than a direct hack into all of its infrastructure. Even so, the exposure of claimant information raised concerns for affected users, especially given the possibility of phishing attempts or identity-based fraud following such incidents.
FTX’s Asset Liquidation Continues
The restoration of the claims portal comes as the FTX bankruptcy estate continues to manage and monetize a large portfolio of digital assets. According to the report, a bankruptcy judge has authorized FTX to liquidate digital assets worth more than $3.4 billion as part of efforts to repay creditors.
The disclosed holdings include roughly $560 million in bitcoin (BTC), $192 million in ether (ETH), and about $1.16 billion in solana (SOL), alongside other crypto assets. Those figures underscore the scale of the estate and the importance of both orderly claims administration and secure communications with creditors.
The asset sales have been closely watched by market participants because of their potential effect on token liquidity and pricing, especially in the case of large concentrated positions. But for claimants, the more immediate issue remains whether the process can proceed efficiently and safely from here.
What It Means for Claimants
FTX’s latest update suggests that the company and its claims partners are attempting to restore confidence after a disruptive security episode. By unfreezing all affected accounts and reopening the portal, FTX is signaling that the claims workflow is back on track. Still, the incident serves as a reminder that cybersecurity vulnerabilities can affect bankruptcy administration just as much as active trading platforms.
For former FTX users, the practical takeaway is that the portal is available again, but caution remains warranted. Given the nature of the breach and the exposure of some personal information, claimants may continue to watch for suspicious outreach or account activity while following the official claims process.
As the bankruptcy case moves forward, two issues are likely to remain central: the security of claimant data and the pace at which FTX can convert assets into distributions for creditors. The reopening of the portal resolves one immediate operational setback, but it does not end broader concerns surrounding privacy, recovery, and trust in the post-collapse process.