The short version
- Ethereum whale wallet 0x9EcA, which bought 27,553 ETH for $63 million on Sunday night, was spending stablecoins stolen from an EU entity that lost $106M+ from exchange accounts, ZachXBT says.
- We checked: at least $22 million of the USDC came straight from ZachXBT’s theft addresses, and both wallets that held the ETH are now empty, with coins moving to bridges, swap services and Monero.
- Next: whether the 12,100 ETH, about $27 million, still sitting a hop or two away reaches an exchange. We’ll post any big move on Base Camp on X.
The Ethereum whale that bought $63 million of ETH overnight on Sunday wasn’t a buyer at all. Onchain investigator ZachXBT says the money was stolen from an EU entity that lost more than $106 million from several exchange accounts on November 1, and the ETH buying was step one of the getaway.
On Monday we followed wallet 0x9EcA as it bought 27,553 ETH and forwarded every coin within minutes, with part of it already leaving Ethereum. We couldn’t say who was behind it. Now we can say what it was. So how did a theft end up looking like a whale buying the dip?
Lookonchain linked the two stories a few hours after ZachXBT’s alert:
According to @zachxbt, an EU entity is suspected of losing $106M+ from multiple centralized exchange accounts.
The attacker used wallet 0x9eca to buy 27,553 $ETH($62.97M) on-chain at an average price of $2,286 and moved the funds through multiple platforms.
What Did ZachXBT Find?
An unnamed EU entity is suspected of losing more than $106 million from multiple centralized exchange accounts, withdrawn as USDC and USDT. ZachXBT posted the alert on his Telegram channel at 12:28 UTC on Monday with 11 theft addresses.
He says the thief spent the next 24 hours swapping USDC for ETH, sending coins to instant exchanges such as WellWallet and Kyrrex, converting to Monero through Wagyu and bridging across chains. He also says, “with a high degree of confidence”, that it is not North Korea’s Lazarus Group, based on how the money is being laundered. Neither the victim nor the exchanges have been named, and nobody has said how the accounts were breached.
We checked the link between the theft and the Ethereum whale ourselves. Five wallets sent the stablecoins that paid for the 27,553 ETH, and four of them were funded straight from addresses on ZachXBT’s list: at least $22 million in USDC came in that way, the rest through other fresh wallets.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Swap $63M of Stablecoins Into ETH?
Because ETH can’t be frozen. Tether and Circle can block USDT and USDC at any address within hours, and they did exactly that with part of the Binance hack last week. Native ETH has no issuer and no freeze button, so a thief holding stolen stablecoins has every reason to swap them fast, even at size.
That also explains the method we saw on Monday. The wallet bought through UniswapX in 35 batches, which got the stablecoins out of reach in about four hours while barely moving the price. A real ETH whale buying the dip would have no reason to hurry like that.
SIDE TRAIL: Ethereum Whale Buys $63M of ETH Overnight, and Some of It Is Already Leaving Ethereum
Where Is the Ethereum Whale’s Stolen ETH Now?
Spread out and still moving. The two wallets that held 24,874 ETH on Monday morning are both empty. One sent its 12,033 ETH to two new wallets in 11 minutes, from 10:29 to 10:40 UTC on Monday. The other paid out in pieces through the day and sent its last 7,115 ETH to a single new address by 18:20 UTC.
From there the coins split again, into bridges such as MetaBridge and into what look like deposit addresses at swap services. The third wallet we flagged on Monday, the one feeding Chainflip, SWFT, Rango and Harbor, received another 900 ETH and still holds 2,419 ETH. At least 12,100 ETH, about $27 million, still sits in four wallets one or two hops from the buyer, according to Blockscout data at the time of writing.
One more lesson for anyone reading whale alerts, and it’s why this crypto theft fooled so many trackers on Sunday night. A brand-new wallet, round stablecoin lots from fresh addresses and coins forwarded within minutes is not what accumulation looks like. It is what moving money you don’t want traced looks like.
Ethereum Price: Did the Theft Hit ETH?
Not visibly. The Ethereum price is $2,255 at the time of writing, down 2.1% in 24 hours with the rest of the market, and back under the $2,286 average the thief paid. The 200-day moving average at $2,158 is the floor that matters, and the 50-day at $2,508 the ceiling. The real risk is the coins still sitting in those wallets: if they reach exchanges and get sold, that is about $27 million of supply that wasn’t there before.
TRAIL MAP: Can Crypto Be Frozen? Who Froze $2.7B of the Binance Hack
TANG has been trading crypto since 2017. The focus is technicals, DeFi and onchain data. On the chart, that means high-timeframe support, moving averages and momentum divergences. Onchain, it means regular checkups on where the data puts the cycle. TANG once ran CryptoJungle, a free community for researching and trading together, and brings that same spirit to Base Camp as one of its co-founders.
More from TANG
