- Pando Rings hacker wallet 0x303D bought 7,548 ETH for $16.72M using ~16.98M DAI during Binance hack selloff
- 4,000 ETH ($9.17M) already deposited into Tornado Cash in 13 transactions of 100 ETH each — flagged by Lookonchain
- 3,548 ETH (~$7.97M) remains in the flagged wallet — laundering cycle not yet complete
Ethereum was trading at approximately $2,249 per ETH when on-chain analysts flagged a wallet linked to a years-old exploit making one of the largest single-address ETH purchases in recent weeks. The broader market was in retreat — a sharp selloff attributed to news surrounding the Binance hack had pushed ETH prices lower — and the activity from address 0x303D0A175CeEC14DD7B3d4F60CABE6CEc06a3d9F went largely unnoticed in the noise. Note: the live price feed at time of publication is showing BNB at $705.77 (-0.87% 24h), reflecting the Binance ecosystem context; the ETH purchases described below were executed at the ~$2,249 level reported by Lookonchain.
The Move:
The wallet attributed to the Pando Rings hacker — an exploiter who allegedly drained approximately $22 million from the Pando Rings protocol roughly four years ago — spent approximately 16.98 million DAI to acquire 7,548 ETH at an average price near $2,249 per ETH, a total outlay of approximately $16.72 million. The purchase appears to have been executed over roughly three days following the Binance-related market decline.
Then, seven hours before Lookonchain’s alert, the same address began moving funds out: 4,000 ETH, valued at approximately $9.17 million, was deposited into Tornado Cash in a series of 100 ETH increments — thirteen transactions visible in the on-chain data, each valued between $228,880 and $229,080. The activity was flagged by Lookonchain and the wallet is traceable on Arkham Intelligence.
What This Signals:
The structure of this activity is not accumulation in any conventional market sense — it is a laundering sequence. On-chain analysts interpret the DAI-to-ETH conversion as a rotation of dormant stolen stablecoins into a more liquid and harder-to-trace asset, timed deliberately during a period of elevated market attention on the Binance incident. The 100 ETH per transaction deposit pattern into Tornado Cash is consistent with standard mixer obfuscation technique, designed to break the on-chain trail before funds re-emerge at a new address.
The remaining 3,548 ETH — approximately $7.97 million at the purchase price — has not yet moved to Tornado Cash at the time of this report, meaning the laundering cycle is incomplete. Watch address 0x303D for further Tornado Cash deposits or transfers to centralized exchange deposit addresses, either of which would mark the next phase of fund dispersal. Attribution here is based on address clustering and historical transaction links from Lookonchain and Arkham — it is not a court-established identity.
Forward Outlook:
The 3,548 ETH still sitting in the flagged wallet is the immediate variable to track. If those funds follow the same 100 ETH increment pattern into Tornado Cash, the total laundered amount will approach the full $16.72 million purchase. Any deviation — such as a direct transfer to a known exchange deposit address — would create an exploitable on-chain trail for investigators. No verified public statement has been issued by Pando Rings, law enforcement, or Tornado Cash at the time of publication.
The episode also illustrates a recurring pattern in crypto exploit history: major market dislocations, like the attention drawn by the Binance hack, provide cover for unrelated dormant wallets to activate. For broader context on how market-moving events correlate with unusual on-chain behavior, see our analysis of Bitcoin vs. US Midterms: 4 Elections, 4 Corrections — Is November 3 Next?.
Frequently Asked Questions
What is the Pando Rings hack and how much was originally stolen?
Why did the hacker use Tornado Cash in 100 ETH increments instead of one transfer?
How much ETH from the purchase has not yet been sent to Tornado Cash?
Source: Lookonchain · Published by CoinsProbe Markets Desk
The opinions and market insights shared on CoinsProbe represent the views of individual authors based on prevailing market conditions at the time of publication. Cryptocurrency investments carry significant risk and volatility. Readers are encouraged to conduct their own research and seek professional financial advice before making investment decisions. CoinsProbe and its contributors do not accept responsibility for financial losses or decisions made based on published content.
CoinsProbe may publish sponsored articles, affiliate links, or promotional collaborations. All sponsored material is clearly labeled to maintain transparency with our audience. Our editorial decisions remain fully independent, and advertising partnerships do not influence reviews, rankings, or published opinions.
Since 2023, CoinsProbe has delivered reliable insights on cryptocurrency, blockchain, and digital assets. Our content is created by experienced researchers and analysts who follow strict editorial standards focused on accuracy, transparency, and credibility. Every article is carefully reviewed and verified using trusted sources and current market data. We provide unbiased analysis and timely updates covering everything from emerging crypto projects to major industry developments.
