Scoutinternal

FTX Creditor 'Go Account' Wallet Invitation and Email Legitimacy Concerns

FTX Creditor "Go Account" Wallet Invitation and Email Legitimacy Concerns

Problem

FTX creditors who created BitGo accounts to receive FTX bankruptcy distribution funds are seeing an unexpected in-app notification reading "You have been invited to join the wallet Go Account with Admin permissions." Many customers suspect this is a scam because the invitation arrives without prior explanation, sometimes alongside an email from the bitgo.info domain (rather than bitgo.com). Customers contact support asking whether the invitation is legitimate, whether they should accept or reject it, and whether accepting compromises their account. This issue affected a very large volume of FTX retail creditors beginning around February 4–6, 2025.

Diagnostics

  • Confirm the customer has an FTX-linked enterprise account in BitGo. Search by the customer's email address or Enterprise ID in the admin tools to verify they are part of the FTX creditor onboarding flow.
  • Check whether the wallet invitation is for a wallet named "Go Account" with Admin permissions — this is the legitimate FTX distribution wallet invitation.
  • Verify the Initiated By field in the wallet invitation shows a BitGo-internal wallet ID (these are hex strings generated during the FTX onboarding process). The invitation is system-generated, not initiated by an external third party.
  • If the customer references an email from the bitgo.info domain with the subject line "Your FTX Funds Are Almost Here", this is a legitimate BitGo marketing/notification email. Confirm the domain bitgo.info is used by BitGo for these communications.
  • If the customer references a KYC email, verify the sender domain belongs to BitGo's KYC verification team. BitGo has its own KYC process independent of FTX Kroll/PwC.
  • Check the wallet share status (Active, Accepted, or Rejected) to determine what action the customer has already taken.

Resolution

Scenario: invitation-join-wallet-scam#legitimate-go-account-invitation

Trigger: Customer sees an in-app notification "You have been invited to join the wallet Go Account with Admin permissions" and asks whether it is legitimate or a scam.

Signals: wallet invitation, Go Account, Admin permissions, scam, legit, FTX, join wallet, reject, accept, bell icon notification

Steps:

  1. Confirm that the customer is an FTX creditor with a BitGo enterprise account linked to the FTX distribution process.
  2. Reassure the customer that the wallet invitation is legitimate and is part of the FTX distribution process. The "Go Account" wallet is where FTX distribution funds will be sent.
  3. Advise the customer that they can either accept the invite or ignore it — BitGo will activate their Go account regardless.
  4. If the customer has already accepted, confirm their account is not compromised and no further action is needed.
  5. If the customer rejected the invitation in error, note that this has been addressed in bulk — these issues were confirmed resolved with the FTX Retail team (confirmed by Michelle Liu). No re-invitation is typically needed as the Go account is activated regardless.
  6. For future reference, advise the customer to ensure they are on the official URL https://app.bitgo.com/ when accepting any invitation. If a link redirects to any external domain outside of app.bitgo.com, they should not accept it.

Notes: This invitation was not originally intended to be visible to end users, which is why customers were confused. BitGo acknowledged that "this invite is not intended to show up for you." The bulk of these tickets were closed after confirmation from the FTX Retail team that the issues were already resolved.

"The invite is for activating your Go account (wallet) where FTX distribution will be sent to. However, this invite is not intended to show up for you. Hence, you can either accept the invite or ignore it as we will be activating your Go account regardless." (ticket #198401)

"Yes, the wallet invitation is legitimate, and you are safe to accept the request. There is nothing to worry. For future reference, please make sure you are on the official URL: https://app.bitgo.com/ when accepting it. If the link redirects you to any external domain outside of app.bitgo.com, please do not accept the invitation, as it would not be legitimate." (ticket #201025)

"The wallet invitation is legitimate, and you are safe to accept the request. Our team will reach out with further details once the FTX disbursement process begins." (ticket #198665)

Scenario: invitation-join-wallet-scam#bitgo-info-email-legitimacy

Trigger: Customer received an email from the bitgo.info domain with subject "Your FTX Funds Are Almost Here" and suspects it is phishing because the domain is not bitgo.com.

Signals: bitgo.info, phishing, scam email, Your FTX Funds Are Almost Here, different domain, not bitgo.com

Steps:

  1. Confirm that the bitgo.info domain is a legitimate BitGo email domain used for FTX-related communications and newsletters.
  2. Explain the content of the email: it instructs FTX creditors to log in to BitGo, check the bell icon in the top right for a notification, and accept the invitation to join their Go Account if one appears.
  3. Reiterate the key timeline information from the email: distribution amounts were to be visible as early as February 8, 2025, with funds not tradable or withdrawable until the official distribution date (February 18, 2025, at 10:00 AM ET).
  4. If the customer has not yet acted on the invitation, advise them they can accept it or ignore it — the Go account will be activated regardless.
  5. Direct any further FTX-specific questions to ftxcreditors@bitgo.com.

Notes: The legitimate email included a reply-to address at the bitgo.info domain. The email body referenced ftxcreditors@bitgo.com as the support contact for FTX issues.

"If you have received an email from the bitgo.info domain regarding the FTX funds, We confirm that this is a legit email. Please join Go Wallet in case you see a notification after logging in." (ticket #199944)

"Yes the email is legit and the invite is for activating your Go account (wallet) where FTX distribution will be sent to. However, this invite is not intended to show up for you. Hence, you can either accept the invite or ignore it as we will be activating your Go account regardless." (ticket #200006)

Scenario: invitation-join-wallet-scam#kyc-email-legitimacy

Trigger: Customer received a KYC verification email from a BitGo email address and suspects it is a scam because the email was sent to an address not associated with their FTX account, or because they already completed KYC through Kroll/PwC.

Signals: KYC, verification, scam, FTX claim, Kroll, PwC, different email, not linked

Steps:

  1. Verify the customer's account in BitGo admin tools and check which email address is linked as a Member in the FTX enterprise. The KYC email is sent to the email address associated with the BitGo enterprise membership, which may differ from the email used with FTX/Kroll.
  2. Explain that BitGo has its own KYC process that is independent of FTX Kroll/PwC. Completing KYC with Kroll does not satisfy BitGo's KYC requirements.
  3. Advise the customer to respond to the KYC email to complete the BitGo onboarding process.
  4. For questions about their FTX Kroll/PwC claim status, direct the customer to contact Kroll support directly.

Notes: Some customers filed claims through both BitGo and Kroll without realizing they were separate processes. BitGo's KYC must be completed for claims handled by BitGo specifically.

"Please note that BitGo has its own KYC process, which must be completed in order for the onboarding to be processed for claims handled by us. We are independent of FTX Kroll." (ticket #189204)

Related