FTX wallets were being drained and the FTX Telegram channel’s admins that detailed its possible malware might be present in FTX-related apps and websites, the company’s new CEO John Ray confirmed there were “unauthorized transactions.” The news was shared by FTX US’s general counsel Ryne Miller and retweeted by FTX’s official Twitter account.

More than $600 million was siphoned from FTX’s crypto wallets late Friday. Soon after, FTX stated in its official Telegram channel that it had been compromised, instructing users not to install any new upgrades and to delete all FTX apps.

“FTX has been hacked. FTX apps are malware. Delete them. Chat is open. Don’t go on FTX site as it might download Trojans,” wrote an account administrator in the FTX Support Telegram chat. The message was pinned by FTX General Counsel Ryne Miller.

Many FTX wallet holders reported $0 balances in their FTX.com and FTX US wallets. FTX’s API appeared to be down, which could account for this. According to on-chain data, various Ethereum tokens as well as Solana and Binance Smart Chain tokens exited FTX’s official wallets and moved to decentralized exchanges like 1inch. Both FTX and FTX US appear to be affected.

The transfers occurred on the same day that the firm filed for Chapter 11 bankruptcy protection in the U.S. after apparently losing – or misappropriating – billions of dollars in user funds. Suspicions – which are conjecture at this point – circulated online about whether, rather than an outside attack, someone inside the company might’ve been responsible.