The ledger does not lie. On August 20, 2024, a wallet address flagged by on-chain analyst Yu Jin executed a series of transactions that, on the surface, appear as a simple buy order on Ethereum mainnet. The data tells a different story—a 9-month arbitrage that netted the actor 1,149 ETH and approximately $18 million in stablecoin profits. This is not a hack. This is a trade. And the on-chain trail reveals the mechanics, the risks, and the blind spots.
Context: The wallet and the timeline
The address in question—let's call it 0xHacker—received 17,124 ETH from Tornado Cash on November 16, 2023. Tornado Cash, a privacy mixer sanctioned by the U.S. Treasury in 2022, breaks the link between sender and receiver. The source of the ETH remains unknown. What is known: 0xHacker swapped those 17,124 ETH for 56.6 million DAI (and a small amount of USDS) on November 19, 2023, at an average price of $3,308 per ETH. The market was in a post-FTX recovery phase, with ETH trading near its 2023 high.
Fast forward 9 months. On August 20, 2024, 0xHacker spent 38.5 million DAI to buy back 18,273 ETH at an average price of $2,109. The ledger shows the buy was executed in multiple batches over 5 hours, likely via a DEX aggregator to minimize slippage. The net result: the hacker now holds 1,149 more ETH than before (18,273 - 17,124) and retains 18.1 million DAI in surplus. The dollar gain is 36% on the initial ETH position, while the quantity gain is 6.7%. The trade is textbook high-sell-low-buy, but with a compliance twist.
Core: Tracing the outflows
I pulled the raw transaction logs from Etherscan and verified each step. The methodology is straightforward: follow the outflows from Tornado Cash to the target address, then map the swap transactions. The data confirms the following chain:
- Block 1 (Nov 19, 2023, 14:32 UTC): 0xHacker sends 17,124 ETH to a Uniswap V3 pool (0x88e6A0c2d...). The swap returns 56,612,000 DAI and 18,400 USDS. The effective price is $3,308 per ETH.
- Block 2 (Aug 20, 2024, 09:15–14:22 UTC): 0xHacker initiates 14 separate swap transactions through 0x aggregator, converting 38,535,000 DAI into 18,273 ETH. The average price is $2,109. The remaining DAI (18,077,000) stays in the wallet.
The numbers are clean. No rounding errors. No dust. This suggests a deliberate algorithm—likely a bot or a script—executed the buy orders to avoid market impact. The 5-hour window indicates time-weighted average pricing (TWAP) logic. The hacker did not panic-sell or chase the market. The trade was planned.
But the ledger also reveals a critical gap: the intermediary addresses. Between the Tornado Cash withdrawal and the Uniswap swap in November, there are three intermediate wallets that each received 5,708 ETH from Tornado Cash. These wallets then forwarded the ETH to 0xHacker within 2 minutes. This is a classic obfuscation layer. The privacy mixer masks the source, but the pattern of split-and-merge is a fingerprint of professional laundering. The hacker is not a novice.
Contrarian: Correlation is not causation
The obvious narrative is that this is a "smart money" signal—a whale who timed the market perfectly. But the data does not support that conclusion. The trade was executed over 9 months, a period that included a 40% drawdown in ETH price. The hacker did not buy at the bottom ($1,520 in January 2024) but waited until August. The buy price of $2,109 is still 30% above the cycle low. This is not a bottom-fishing strategy; it is a mean-reversion play.
More importantly, the use of Tornado Cash introduces a compliance risk that may nullify the profit. Any exchange that applies OFAC sanctions screening will flag the incoming ETH from a Tornado Cash-linked address. The hacker may be unable to sell the ETH through regulated venues. The 18 million DAI surplus is safe (stablecoins are not directly sanctioned), but the 18,273 ETH could be frozen on centralized exchanges. The only exit is through decentralized exchanges or OTC deals, which are less liquid and carry counterparty risk.
The real insight is not the trade itself but the structural risk of privacy tools. Tornado Cash was sanctioned because it enables money laundering. The hacker's profit is built on a foundation of regulatory non-compliance. The ledger records the profit, but the outcome depends on whether the hacker can convert that profit into spendable value. The market is not a closed system; the chain is not the only ledger.
Takeaway: The next signal
The hacker's wallet now holds 18,273 ETH and 18.1 million DAI. The next move will be instructive. If the ETH is transferred to a centralized exchange, the exchange will likely freeze the funds, triggering a compliance report. If the ETH is swapped on Uniswap for stablecoins, the slippage will be minimal but the volume will be tracked. The on-chain data will record the next step.
The real signal for analysts: watch for any movement from this address. If the hacker successfully extracts value, it will indicate a gap in enforcement. If the funds remain stagnant, the trade becomes a trapped profit. The ledger does not lie, but the legal system does not always follow the chain.