BTC $76,756 
ETH $2,255 
MGLOEURO $111,813 
USDT $0.9986 
BNB $698.47 
XRP $1.25 
USDC $0.9993 
SOL $92.08 
TRX $0.3186 
FIGR_HELOC $1.07 Hacks & Security · Explained
ZachXBT links 27,553 ETH 'whale' buy to suspected $106 million hack
The overnight ether purchase looked like bullish whale activity, but ZachXBT ties the wallet to a suspected $106 million theft from an EU entity.
Key takeaways
- Not a whale. Wallet 0x9EcA spent $62.97 million on 27,553 ETH, buying that Lookonchain initially flagged as bullish whale activity, before ZachXBT tied the funds to a suspected theft.
- Why ETH first. USDC can be frozen by its issuer while ether cannot, so converting stablecoins into ETH quickly is a common early step after a hack.
- Still moving. Part of the money went to instant exchanges, bridges to Tron and the privacy coin Monero, while roughly 7,844 ETH remained in one wallet as of 14:35 UTC.
What happened
A wallet that onchain trackers first read as an aggressive buyer of ether was in fact spending the proceeds of a suspected $106 million theft, according to the investigator ZachXBT. In a community alert posted to his Telegram channel on Nov. 2, he said more than $106 million appears to have been taken a day earlier from an EU entity's accounts at multiple centralized exchanges.
The wallet, identified as 0x9EcA, drew attention in the early hours of Nov. 2 when the tracker Lookonchain reported that it had spent $37.96 million of USDC on 16,658 ETH within two hours at an average price of $2,279. By the time the buying stopped, the wallet had spent $62.97 million at an average of $2,286, acquiring 27,553 ETH.
A flow map credited to ZachXBT, the investigator Specter and the analytics firm TRM Labs shows the stablecoins leaving at least three exchange accounts on Sunday and passing through dozens of newly created wallets before reaching 0x9EcA. The source wallets are labeled only as Exchange 1, 2 and 3.
ZachXBT said the money was withdrawn as USDC and USDT, and that he could state with a high degree of confidence the culprit was not North Korea's Lazarus Group, citing multiple laundering indicators that he did not describe. The alert did not name the victim, the exchanges involved or how the accounts were accessed, and described the actor as still unidentified.
First $2.7KLatest $2.3K-15.6% over the period
Points are daily observations, not closing prices.
Why it matters
The case shows how quickly a large theft can be disguised as ordinary market activity. Because Circle can freeze USDC at the issuer level but no one can freeze ether, swapping stablecoins into ETH within hours is a standard early move for someone trying to keep stolen funds out of reach. The overnight bid was real money, but it was not organic demand.
From there, the trail splits in ways designed to slow investigators. Some funds went to instant exchange services including WellWallet and Kyrrex, some was bridged to Tron-format addresses, and part was converted to Monero through the swap service Wagyu. Monero hides sender, receiver and amount by default, leaving only the balances still parked at public Ethereum addresses and the hops through named services as visible onchain evidence.
What the data shows
The investigators' map shows about 2.64 million USDC moving on Nov. 2 to an address that feeds a cluster tagged as Wagyu, and 2,200 ETH going to an address that then bridged funds to a Tron-format address. ZachXBT listed 11 Ethereum addresses tied to the theft.
The Ethereum ledger shows 0x9EcA passing on almost all of the ETH within hours of buying it. A second wallet, 0x65C3, has been distributing it gradually: 3,100 ETH to a wallet the map shows bridging to Tron, 2,358 ETH to another address, and smaller amounts to at least seven more, along with test transfers to the cross-chain services SwftSwap and Rango. As of 14:35 UTC, 0x65C3 still held 7,844 ETH, about $18 million at a price of $2,290, while 0x9EcA retained 310 ETH. Ether was up about 1% on the day, close to the thief's $2,286 average purchase price.
Background
The alert came days after Binance's hot wallets were drained on Oct. 29, a theft that TRM Labs attributed with high confidence to TraderTraitor, a North Korean hacking unit. ZachXBT's assessment that the new incident is not the work of Lazarus Group, the broader North Korean operation, separates the two events, though he did not explain which indicators led him to that conclusion.
What is still unclear
Several central questions remain open. The EU entity has not been identified, the exchanges holding the accounts have not been named, and no exchange or victim had publicly confirmed a loss as of publication. How the accounts were accessed is also unknown. The portion of funds converted to Monero is likely to stay out of view, and the value still sitting in identified wallets could move at any time.
What to watch
The next signals will come from the exchanges and issuers involved. A confirmation from a victim or a trading venue, any freeze of stablecoin balances by Circle, and movement of the remaining ether in 0x65C3 and 0x9EcA are the visible checkpoints. Transfers on the Tron side and any further conversions through swap services will show whether the laundering pattern described by the investigators continues.
Questions readers ask
Who is ZachXBT?
ZachXBT is an onchain investigator who publishes findings on crypto thefts and laundering through his Telegram channel and social accounts. His Nov. 2 alert on this case was accompanied by a flow map produced with Specter and TRM Labs.
Why did the thief buy ether?
Ether cannot be frozen by an issuer, while USDC can. Converting stablecoins into ETH quickly reduces the chance the funds are blocked, and the purchases looked like normal whale accumulation to market trackers.
Has anyone confirmed the loss?
No. The reports say the EU entity, the exchanges and the method of access have not been disclosed, and no exchange or victim had publicly confirmed a loss at the time of publication.
