The “Whale” Buying 27,553 ETH Overnight Was a Thief: ZachXBT Ties It to a Suspected $106 Million Crypto Hack

On Monday, November 2, a suspected $106 million crypto hack targeting an EU entity’s exchange accounts came to light when investigator ZachXBT linked 27,553 ETH—purchased overnight by a wallet widely mistaken for a bullish whale—to the stolen funds.

Initially, the purchasing activity appeared positive. Lookonchain reported “whales buying ETH like crazy” at 01:17 UTC, noting that wallet 0x9EcA utilized $37.96 million in USDC to acquire 16,658 ETH across a two-hour window. By the conclusion of its buying spree, the wallet had deployed $62.97 million at an average price of $2,286.

Funding originated from a minimum of three centralized exchange accounts. According to a mapping compiled by ZachXBT, investigator Specter, and analytics firm TRM, the USDC departed these platforms on Sunday, moved through dozens of newly created wallets, and ultimately arrived at 0x9EcA.

This conversion was a critical step. While Circle possesses the ability to freeze USDC at the issuer level, ETH cannot be frozen by any single entity. Consequently, converting stablecoins into Ethereum rapidly is a typical initial tactic following a heist.

To date, no victim has been identified, and exchanges have yet to issue statements.

Whales are buying $ETH like crazy on-chain!

Over the past 2 hours, whale 0x9EcA spent 37.96M $USDC to buy 16,658 $ETH at an average price of $2,279.

The whale is still buying!https://t.co/aua683wTF0 pic.twitter.com/okLzKm9c5h

— Lookonchain (@lookonchain) November 2, 2026

DISCOVER: Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack

Where Is the ETH From the Crypto Hack Now?

The funds were distributed and remain partially unspent. On-chain data from Ethereum shows that 0x9EcA transferred nearly all of its newly purchased ETH within hours of acquisition:

• Nov 1, 23:46 to Nov 2, 00:26 UTC: 15,085 ETH sent to wallet 0x65C3…b841 across eight separate transactions.
• 00:40 to 03:56 UTC: 12,033 ETH sent to wallet 0xBe95…a85a across 25 separate transactions.
• 10:29 to 10:40 UTC: 0xBe95 distributed its entire balance into two new addresses, moving 6,217 ETH and 5,816 ETH.

Wallet 0x65C3 is currently disbursing funds incrementally. It has funneled 3,100 ETH to an address identified by investigators as bridging assets to Tron, 2,358 ETH to an alternative address, and smaller fractions to at least seven additional destinations. Furthermore, it conducted test transactions with cross-chain platforms SwftSwap and Rango.

As of 14:35 UTC, wallet 0x65C3 retained 7,844 ETH, valued at approximately $18 million based on the day’s price of $2,290. Meanwhile, 0x9EcA holds an additional 310 ETH.

Other portions of the $106 million security breach took alternative paths. The tracking map indicates that direct USDC transfers went to instant swap services, Wagyu, and Kyrrex, with some amounts subsequently bridged to Tron.

EXPLORE: BTC USD Holds $78,000 As OneKey’s Founder Warns North Korean Hackers May Already Have BlackRock’s IBIT on Their List

Could There Be Any Consequence for the Ethereum Price?

Market Cap

24h
7d
30d
1y
All Time

That overnight accumulation represented substantial capital, though its bullish effect is temporary. Ethereum currently trades at $2,290—reflecting a 1% daily gain that aligns closely with the perpetrator’s $2,286 purchase average—meaning the $62.97 million buying spree temporarily boosted overnight demand.

However, this Ethereum now constitutes a supply overhang. Cross-chain bridges and swap protocols convert the asset into alternative cryptocurrencies, prompting market sales on the receiving end of each transfer. Additionally, roughly $18 million remains parked inside a single holding wallet.

DISCOVER: 10+ Next Crypto to 100X In 2026

Follow 99Bitcoins on X For the Latest Market Updates, and Subscribe on YouTube For Daily Expert Market Analysis.