FTX creditor activist Sunil Kavuri says a leak of creditor names and emails likely came from FTX or its claims agent Kroll after a SIM swap on a Kroll employee, and fraudsters are now sending phishing emails as payouts near on Sept. 30, 2025.
Data leak and phishing
Sunil Kavuri revealed that a list of FTX creditor names and email addresses has been exposed. The leak likely traces back to either FTX or the claims agent Kroll. Investigators say a SIM-swapping attack on a Kroll employee is the probable cause.
Since the leak, creditors have reported phishing messages that mimic FTX. The fake emails try to trick recipients into clicking links or handing over details.
Also Read: FTX Commences $5 Billion Second Payout to Verified Creditors
How did the breach happen?
A SIM-swap gives attackers control of a victim’s phone number, and that lets them receive texts and calls used for account recovery. Sources point to such an attack on a Kroll staff member as the starting point.
Once the attackers had access, they could retrieve or copy contact lists. Those lists then became the target list for phishing campaigns.
Creditor warnings and scams
Sunil has warned creditors directly on X(Twitter) that scammers were sending false emails and trying to steal data. In March 2025, UnoCrypto earlier reported its alert about the fake messages.
Officials and security experts tell creditors not to click links in unexpected emails, and they should check the sender address and use only the official claims portal to submit any documents. If in doubt, reach out to Kroll or the official FTX claims channel through verified contacts.
Tax concerns and payout risks
Creditors now face not just fraud risk but also heavy tax uncertainty. Sunil said the proposed debt distribution plan could lead to tax hits of 30% to 40% for those owed money. The current plan relies mainly on payments in U.S. dollars.
That mechanism can trigger local tax events for recipients in many countries. Creditors fear that large parts of their recoveries will be eaten up by taxes and fees before they receive any net funds.
Timing and stakes
FTX is preparing to start creditor payouts on Sept. 30, 2025, and that date raises the stakes for anyone on the creditor list. The leak and the rising number of phishing attempts come just weeks before the first payments.
For many people, this is the first clear sign they may see money back from the collapse. At the same time, the leak makes those same people prime targets for fraud.
What does this mean?
The leak weakens trust in the claims process, and creditors already face long waits and complex rules. Now they must also guard against scams that could cost them personal data or money.
The tax issue adds another layer of loss that many did not expect. Together, these problems may change how people approach the payout process and how they secure their accounts and devices.
Many creditors are anxious and angry, and some want clearer guidance on how taxes will be handled. The watchdogs and legal advisers who follow the case expect more scrutiny of the claims process. Regulators and security teams will likely press for stronger safeguards.
Also Read: FTX Creditors Will Have To Wait Till October For Distribution Of Funds