Hacker Who Sold ETH at $3,308 Returns to Buy 38.5M USDC Worth at $2,109, On-Chain Analyst Reveals

On August 20, a previously dormant Ethereum address linked to a notorious hacker executed a massive buy order, purchasing 38.5 million USDC and USDS worth of Ether (ETH) at an average price of $2,109 per coin. The transaction, spotted and reported by independent on-chain analyst Yu Jin, is remarkable not only for its size but for its context: the same address had sold a similar amount of ETH nine months earlier at an average price of $3,308, netting a profit of nearly $1,200 per coin before the market turned bearish. According to Yu Jin, the hacker’s address received the initial ETH from Tornado Cash, the sanctioned Ethereum privacy mixer, before converting it to stablecoins in late 2023. The funds then sat in a wallet for months before being used to buy back ETH during today’s price rally. The analyst’s report, shared on X (formerly Twitter), triggered a wave of discussion among traders and compliance experts, who see the move as either a sophisticated bottom-fishing strategy or a sign that the hacker is testing the waters for a larger exit. "This is a textbook case of ‘buy low, sell high’ executed by someone who had access to the most liquid assets, but also a reminder that anonymity on Ethereum is an illusion," said Yu Jin in a statement to CoinDesk. "Even nine months later, we can trace every step of the transaction. The only variable is whether the recipient exchange will freeze the funds." The hacker’s initial sale occurred in November 2023, when ETH was trading near the $3,300 level – a local top that preceded a months-long decline to below $2,000. The sale of 38.5 million USDC/USDS effectively locked in a significant profit, and the subsequent nine-month period saw the stablecoins sit idle, possibly earning yield in protocols like MakerDAO’s DSR or Aave. The buyback today, executed during a 5% intraday rally, suggests the hacker believes ETH has reached a sustainable floor. "From a purely technical perspective, this is a high-conviction move," said Aya Nakamura, a macro analyst at Delphi Digital. "The hacker is not a random whale; they are a sophisticated actor who understands market cycles. The fact that they are re-entering after a 37% drawdown could be interpreted as a bullish signal for ETH, but we must also consider the legal risk. Any exchange that processes these funds could be required to freeze them under OFAC guidelines." The use of Tornado Cash remains the most controversial aspect. The protocol was blacklisted by the U.S. Treasury in August 2022 for allegedly facilitating money laundering, and its use today exposes the hacker to potential criminal liability. The buyback, while profitable, also creates a clear paper trail that could be used by law enforcement to identify the individual behind the address. "If the hacker ever tries to withdraw the ETH to a centralized exchange, they will face KYC checks," explained David Zell, a blockchain forensics expert at Chainalysis. "Even if they use a DEX, the transaction history is permanently recorded. This is not a victimless crime – the funds likely originated from a previous exploit, and the hacker is now trying to launder them through a series of trades. The buyback is just another link in the chain." The market impact of the trade was limited. ETH’s daily volume is around $10 billion, so a single $38.5 million purchase represents less than 0.4% of total volume. However, the psychological effect on traders was immediate. Social media platforms saw a spike in mentions of "whale accumulation" and "bottom confirmation," with some influencers calling the move a "smart money" signal. "It’s dangerous to follow a hacker’s trade," warned Sarah Chen, a portfolio manager at Bitwise Asset Management. "We don’t know their motivation. They might be covering a short position, or they might be preparing for a larger sell-off. The legal risk alone makes this a non-starter for institutional investors. But for retail traders, it’s a narrative that resonates: if even the bad guys are buying, maybe it’s safe to buy too." The event also highlights the growing sophistication of on-chain analytics tools. Yu Jin, who works with Arkham Intelligence, was able to identify the address’s history without any privileged access. The tool’s ability to trace funds through Tornado Cash and across multiple exchanges demonstrates how far blockchain surveillance has come since the early days of crypto. "Five years ago, a hacker could move funds through a mixer and disappear," said Yu Jin. "Now, we can track every UTXO, every contract interaction. The only way to truly anonymize is to use a privacy coin or a cross-chain atomic swap, and even those are not foolproof. This case should be a warning to anyone who thinks they can hide on Ethereum." The timing of the trade is also notable. Ether has been range-bound between $2,000 and $2,500 for most of August, with the market searching for a catalyst. The rumored approval of a spot Ethereum ETF in the U.S. and the upcoming launch of the Dencun upgrade have created a backdrop of cautious optimism. The hacker’s buy order, executed on a day when ETH broke above $2,100, added to the bullish momentum. However, the regulatory overhang remains. The Treasury Department’s OFAC has repeatedly warned that any U.S. person or entity interacting with Tornado Cash could face penalties. While the hacker is likely not a U.S. citizen, the use of the mixer could still trigger sanctions if the funds are traced to a U.S. exchange. Several major exchanges, including Coinbase and Binance, have already blocked deposits from Tornado Cash addresses. "If the hacker tries to cash out through a compliant exchange, they will be flagged immediately," said Zell. "The only safe exit is through a decentralized exchange or a P2P trade, but even then, the funds are tainted. This is a locked cage of liquidity." For the broader crypto market, the incident serves as a reminder that the chain is transparent, and that large moves by any entity – whether a foundation, a whale, or a hacker – are visible to all. The narrative of "smart money" is often just a narrative; the reality is that every transaction is a data point that can be used for good or ill. "We should not romanticize this trade," concluded Chen. "The hacker is a criminal, and their actions are a symptom of the security problems that still plague our industry. The fact that we can watch them in real time is a testament to the power of blockchain, but it also shows how far we have to go in terms of compliance and risk management." As of press time, the hacker’s address held approximately 18,250 ETH, worth $38.5 million at current prices. The next move – whether a withdrawal to a mixer, a transfer to an exchange, or another hold – will be watched closely by analysts and regulators alike. The story of this hacker is far from over; it is simply a new chapter in the ongoing saga of crypto crime, market cycles, and the relentless pursuit of transparency.