AnswersPublished18 sources
A $63 Million ETH Buy Looked Bullish—Until Investigators Linked It to a Suspected Theft
Lookonchain later linked wallet 0x9EcA’s purchase of 27,553 ETH for $62.97 million to funds tied to a suspected theft exceeding $106 million. The suspected attacker was reported to have withdrawn USDC and USDT from multiple exchange accounts, then moved funds through ETH, instant exchanges, Monero and cross chain ro...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Lookonchain later linked wallet 0x9EcA’s purchase of 27,553 ETH for $62.97 million to funds tied to a suspected theft exceeding $106 million.
- The suspected attacker was reported to have withdrawn USDC and USDT from multiple exchange accounts, then moved funds through ETH, instant exchanges, Monero and cross chain routes.[1][21][26]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: How did Lookonchain’s November 2 reassessment, citing investigator ZachXBT, link wallet 0x9EcA’s overnight purchase of 27,553 ETH for $62.97. Article summary: Lookonchain’s November 2 reassessment changed the interpretation of 0x9EcA’s buying: citing ZachXBT, it linked the wallet’s 27,553 ETH purchase to suspected stolen funds, rather than ordinary bullish whale accumulation.[. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
A large ETH purchase can look like a vote of confidence in the market. On November 2, Lookonchain initially flagged wallet 0x9EcA as a whale buying ETH; later, citing investigator ZachXBT, it linked the wallet’s purchases to funds associated with a suspected theft from an unnamed European Union entity.7
8
38
The reported purchase—27,553 ETH for $62.97 million—was not the same as the suspected loss. Investigators put the loss at more than $106 million across multiple centralized-exchange accounts, so the ETH buy represented only part of the reported amount.1
7
From whale alert to suspected theft link
At 01:17 UTC, an alert reported that 0x9EcA had spent $37.96 million in USDC to buy 16,658 ETH over two hours, at an average price of $2,279, and was still buying.38 Lookonchain separately described the completed activity as a $62.97 million purchase of 27,553 ETH over five hours, at an average of $2,286.
8
The later attribution changed how the buying should be read. Lookonchain said, citing ZachXBT, that the suspected attacker used 0x9EcA to buy the ETH and moved funds through multiple platforms.7 That makes the purchase a reported part of suspected fund movements—not evidence on its own that a trader was “buying the bottom.”
What investigators reported about the fund movements
Reporting based on ZachXBT’s alert says funds were withdrawn from multiple exchange accounts in USDC and USDT. The suspected attacker then moved funds through several assets and services, including swaps into ETH, instant exchanges such as Kyrrex and WellWallet, conversions into Monero through Wagyu, and cross-chain transfers.1
21
26
One report said ZachXBT published 11 Ethereum addresses associated with the suspected theft.18 That provides leads for tracking transactions, but does not by itself identify the victim, explain how the accounts were accessed, or establish the full route of every asset.
What remains unknown—and what the buying says about ETH
The entity was described as an unidentified EU organization, and the affected exchanges were not named in the available reporting. The reports also do not establish how the accounts were compromised.1
22 The evidence therefore supports describing the incident as a suspected theft, not treating the victim’s identity or the attack method as confirmed.
The ETH purchase should not be mistaken for a reliable market signal. If ETH was acquired as part of moving suspected stolen funds, the transaction does not show ordinary investment intent or confirm a market bottom. Later conversions could create selling pressure, but the available reports do not establish whether, when, or how much ETH might be sold.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "A $63 Million ETH Buy Looked Bullish—Until Investigators Linked It to a Suspected Theft"?
Lookonchain later linked wallet 0x9EcA’s purchase of 27,553 ETH for $62.97 million to funds tied to a suspected theft exceeding $106 million.
What are the key points to validate first?
Lookonchain later linked wallet 0x9EcA’s purchase of 27,553 ETH for $62.97 million to funds tied to a suspected theft exceeding $106 million. The suspected attacker was reported to have withdrawn USDC and USDT from multiple exchange accounts, then moved funds through ETH, instant exchanges, Monero and cross chain routes.[1][21][26]
Sources
lookonchain.comEU Entity Loses $106M+ Across CEX Accounts; Attacker Buys 27,553 $ETH for $62.97M - Lookonchain - Looking for smartmoney onchain
phemex.comWhale Buys 16,658 ETH Worth $37.96M at $2,279 Average Price | Phemex News
coinpedia.orgEU Entity Suspected of $106M in Crypto Exchange Heist