Kroll scam emails: how to spot the fake FTX claim and breach notices
Quick answer
Kroll is a real company that handles bankruptcy claims and breach notifications. Scammers send emails pretending to be Kroll or the FTX bankruptcy team. Kroll says it will never ask for your wallet, seed phrase, password or Social Security number. Don't click. Go to Kroll's site yourself.
- Pretends to be
- Kroll
- Last updated
How it works
Kroll Restructuring Administration is the claims agent in the FTX bankruptcy. In August 2023 Kroll reported a security incident that exposed information about some claimants in that case and two other cryptocurrency bankruptcies. Kroll says the data included names, email and mailing addresses, phone numbers, account balances and claim details, and for a limited number of people, dates of birth.
Scammers use that kind of event as cover. Kroll's own FAQ warns of phishing emails that impersonate parties in the bankruptcy, such as a message saying withdrawals are now available on your FTX account.
The email links to a fake claims or wallet page. The goal is to get you to connect your crypto wallet, hand over a seed phrase or private key, install software or type a password. Anyone with a seed phrase can empty a wallet.
Kroll also sends real breach notification letters for other companies. If you got one, the letter carries the phone number to call. Kroll's incident hotlines can't help with credit or identity monitoring services, so a caller who says they can is a warning sign.
Red flags
- An email saying FTX withdrawals or payouts are available now, with a link to claim
- A request to link a crypto wallet to a website or app
- A request for your seed phrase, private keys or password
- A request to download software or use a particular wallet app
- A request for your birthday or Social Security number by email, social media or text
- A sender address that doesn't match the official Kroll or claims site
Example message
Important notice from the FTX claims administrator: your distribution is ready. To receive your funds, verify your wallet at [link] within 48 hours. Questions? Reply to this email or call [phone number].
What to do
- 1
Don't click or reply
Delete the email. Don't open attachments or use any link or number in it.
- 2
Check claims information at the source
Kroll tells claimants to confirm anything about the FTX bankruptcy on its official claims site or by contacting its restructuring team, not through a link in a message.
- 3
If you linked a wallet or gave a seed phrase, move your funds
Create a new wallet with a new seed phrase on a clean device and move what you can. Treat the old wallet as compromised.
- 4
If you gave a password, change it
Change it on the real site and anywhere else you used it, and turn on two-step verification.
- 5
If you shared your Social Security number or birthday
Consider a credit freeze with the three credit bureaus and watch your accounts for new activity.
- 6
Got a breach letter that mentions Kroll?
Use the phone number printed in the letter, not one from an email or search result.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers aiming at FTX claimants and breach victims often work from leaked lists of names, emails and phone numbers, then add details from people-search sites to sound credible. Serus finds the data brokers that list your details and removes them, and alerts you when your data shows up in a breach, so fewer scammers can reach you with a message that feels personal.
Frequently asked
Is Kroll a scam?
No. Kroll is a real company. Scammers copy its name and the FTX bankruptcy's name in phishing emails.
Will Kroll or the FTX court ask for my seed phrase?
No. Kroll says neither it, the court nor FTX will ask you to link a wallet, share a seed phrase or private keys, download software, or give a password by email, text or phone.
How do I know if my information was in the Kroll incident?
Kroll says it notified affected claimants directly by email. If you got a notice, follow what it says and check any claim information on Kroll's official site.
I got a breach letter offering credit monitoring. Is it real?
Use the phone number printed in the letter. Kroll says its security incident hotlines can't help with credit or identity monitoring.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
