An unidentified actor associated with a previous security breach has executed a massive series of transactions, spending 38.535 million DAI and USDS to acquire 18,273 ETH. According to data provided by on-chain analyst Ember, the buying spree occurred within a five-hour window on August 20, 2026. This move marks a significant shift in the hacker’s portfolio management, signaling a return to volatile assets following a prolonged period of holding stablecoins.
Strategic Accumulation During Market Rebound
The acquisition was executed at an average price of $2,108 per ETH, timed during a period of strong upward momentum for the Ethereum network. Analysts note that these funds were not new capital but rather the result of a long-term trading cycle. The capital used for this purchase originated from the liquidation of 17,124 ETH approximately nine months ago. By selling at a higher valuation previously and repurchasing during the current rebound, the hacker has effectively increased their total Ether holdings.
- Total Stablecoins Spent: 38.535 million (DAI and USDS)
- Total ETH Acquired: 18,273 units
- Average Purchase Price: $2,108
- Source of Funds: Tornado Cash mixer transactions
Tracing the On-Chain History
The history of these specific funds points toward a sophisticated attempt to obscure the trail of illicit assets. The original 17,124 ETH were initially routed through Tornado Cash, a decentralized privacy protocol on the Ethereum blockchain, before being converted into stablecoins to preserve value during market volatility. Tornado Cash has been a focal point for regulators due to its frequent use by exploiters seeking to break the link between sender and recipient addresses. By moving back into Ethereum, the actor is once again exposed to the price fluctuations of the broader crypto market.
The scale of these transactions highlights the ongoing challenge of monitoring illicit financial flows within decentralized finance (DeFi). While the stablecoins DAI and USDS provided a temporary hedge, the hacker’s decision to reinvest in Layer-1 assets suggests a calculated bet on the continued recovery of the digital asset sector. Market observers continue to track the associated wallet addresses to determine if these funds will be moved to centralized exchanges or remain within the privacy-centric layers of the ecosystem.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.