According to reports, the FTX attacker had previously preferred THORSwap, but it entered maintenance mode on Oct. 6 in order to stop any additional potential illegal activities.