Nine months ago, someone sold 17,124 ETH at $3,308.
Today, they spent $38.5 million to buy back 18,273 ETH at $2,109.
Net result: 1,149 ETH profit. Plus roughly $18 million in stablecoins still sitting in the wallet.
That's a 36% dollar gain and a 6.7% increase in ETH stack.
Textbook high-sell, low-buy.
But there's a catch. The original ETH came from Tornado Cash.
And Tornado Cash is sanctioned by the U.S. Treasury.
So this isn't just a trade. It's a regulatory time bomb.
Let me walk through the numbers and the risks.
Context: The Market Structure
This transaction was flagged by analyst Yu Jin on August 20, 2024. The hacker's address is known. The chain of events is clear:
- Nine months ago (late 2023), the hacker withdrew 17,124 ETH from Tornado Cash.
- They sold it all at $3,308 per ETH, netting roughly 56.6 million DAI/USDS.
- Now, in August 2024, with ETH trading around $2,109, they used 38.5 million of those stablecoins to buy back 18,273 ETH.
- The remaining 18.1 million stablecoins stay in the wallet.
Why now? ETH is in a recovery phase. From its 2024 low near $1,500, it bounced to $2,100+. The hacker likely sees this as a value zone.
But the market doesn't know this address. It's a ghost.
Core: Order Flow Analysis
Let's break down the P&L like a quant.
First trade (sell): - 17,124 ETH x $3,308 = $56,643,792
Second trade (buy): - 18,273 ETH x $2,109 = $38,538,357
Cash left: $56,643,792 - $38,538,357 = $18,105,435
ETH position change: +1,149 ETH (18,273 - 17,124)
Dollar profit: $18.1 million still in stablecoins. That's locked profit.
But the ETH count is higher. That means the hacker didn't just flip dollars for more dollars. They also increased their crypto exposure.
If ETH goes to $3,000, the 18,273 ETH would be worth $54.8 million. Add the $18.1 million stablecoins, total $72.9 million. That's a 29% return on the original $56.6 million.
If ETH goes to $1,500, the ETH portion drops to $27.4 million. Total $45.5 million. That's a 20% loss on the original capital.
So the hacker is effectively long ETH with a cost basis of $2,109. They have a cash buffer of $18.1 million.
Smart money doesn't hold that much cash unless they expect a deeper correction.
But here's the twist: the incoming cash flow is tainted.
Contrarian: Retail vs. Smart Money
Retail sees this and thinks: "Smart money is buying ETH at $2,100. I should buy too."
That's wrong.
This isn't a fund. It's a hacker who used Tornado Cash. The moment they try to sell those ETH through a centralized exchange, the exchange's compliance team will freeze the funds.
Chainalysis and similar tools have flagged this address. The hacker's only exit is through decentralized exchanges (DEX) or over-the-counter (OTC) deals with willing buyers.
DEX liquidity is thin. Sell 18,273 ETH on Uniswap? You'll get wrecked on slippage. OTC buyers will demand a discount – maybe 10-20% below market.
So the real profit is lower.
Yield is the rent you pay for holding someone else's risk. In this case, the rent is the regulatory risk premium.
We don't trade with sanctioned funds. Period.
This person is a ghost. They can't use the financial system. They can't marry their gains to fiat without a massive haircut or legal exposure.
So the headline "Hacker buys 18,273 ETH" is misleading. It's not a bullish signal. It's a reminder that on-chain privacy tools come with strings attached.
Takeaway: Actionable Price Levels
If you're tracking this address, watch the ETH price at $2,100.
If ETH breaks below $2,000, the hacker's ETH position goes underwater. But they still have $18.1 million in cash. They can wait.
The real risk is a regulatory crackdown. If the U.S. Treasury adds more Tornado Cash addresses to the SDN list, any exchange that interacts with this wallet could be fined.
So the smart money move is not to follow this trade. It's to avoid any address that has touched Tornado Cash.
Clean money flows where the risk is lowest.
This isn't a signal. It's a stain.